Lead review
Suspicious score 100/100 · link cluster · 5 accounts · 5 posts
View in 3D: where it comes from and what it is linked to
Part of a campaign: FactsLens campaign report: coordinated multi-platform cluster network, 2026-11-14 (15 clusters, 86 accounts), linked by Nemotron.
First seen Sat 14 Nov 14:29 UTC, last Sat 14 Nov 18:43 UTC. Languages: en 4fi 1 Linked: gallery.rybar.ru 5
Coordinated activity that touches documented propaganda infrastructure.
This is a lead for a human reviewer, not an accusation. Signals are measured; thresholds are starting values evaluated on the metrics page.
Account profiles fetched: 100%.
Nemotron investigation
Staged confidence high · recommended: human review
Five accounts posted the same link to a rybar.ru image gallery within one minute on 2026-11-14, in Italian and Spanish, claiming that a Ukrainian drone (RZ-100 "Morok" by PRAT "RAMZAI") attacked Moscow and that Americans will buy it, with alleged rebranding from Ukrainian to American/British and Western acquisition of battle-tested weapons. The posts include four images: an infographic and Russian-language documents resembling export licences.
Narrative: A Ukrainian drone attacked Moscow; Americans are buying it and rebranding it from Ukrainian to American/British. Ukrainian developers sell products under the guise of attracting investment, while the West acquires ready-to-use, battle-tested weapons.
Strongest innocent explanation considered: Independent readers or fans of the Russian Telegram channel Rybar shared the same news story about a drone attack on Moscow, possibly via share buttons or Mastodon-to-Bluesky bridges.
- >staged: S:new_accounts = 100% (all accounts created in the last 30 days); S:low_reach = 100% (fewer than 10 followers each); S:synchrony = 60% (all five posts within one minute, 14:29–14:29 UTC); S:cross_cluster = 100% (every account appears in at least two other flagged clusters within 24 h); S:listed_servers = 80% (bridged from Mastodon servers on IFTAS’s list); S:telegram_first = 4.5 (same content appeared on Telegram rybar 4 minutes before the first Bluesky post); S:copy_paste = 40% (near-identical text repeated across accounts in Italian and Spanish).
- >organic: S:removed_accounts = 0%; S:empty_profiles = 0%; S:template_bios = 0%; S:known_accounts = 0; S:known_domains = 0; S:declared_automation = 0%; independent news confirms drone strikes on Moscow around 11–13 November 2026 (Q2, N1–N8).
Manipulation techniques
| Technique | Exact words | Why | Post |
|---|---|---|---|
| loaded_language | “прибрать к рукам готовое к применению оружие” | Frames the transfer of weapons as theft or appropriation rather than ordinary commerce. | P1 |
| loaded_language | “«Смена шильдиков» с украинского на американское/британское” | Implies deceptive rebranding or badging of origin. | P1 |
Sources
| Domain | Trust | Why |
|---|---|---|
| rybar.ru | low | domain_info returned no registration date, age, or registrar; not on VIGINUM/CheckFirst propaganda lists (S:known_domains = 0); describes itself as a Russian military analytical centre (W3); flagged as a Pravda republication source (S:pravda_sources = 1, a lead not proof). |
| gallery.rybar.ru | low | Hosts the shared images (I1–I4); no separate web page content to inspect; tied to the same Russian military-affiliated source. |
Images and video
Images are blurred: click one to show it. They load from the platform's own servers.
- search this picture: Google Lens · TinEyeI1 Infographic titled "УКРАИНСКИЙ ДРОН НА АМЕРИКАНСКИЙ РЫНОК" showing the RZ-100 "МОРОК" drone, manufacturer PRAT "РАМЗАЙ", specifications, and a map suggesting a route from the USA to Ukraine/SVO. Supports the text by naming the drone, manufacturer, and alleged market.
- search this picture: Google Lens · TinEyeI2 Russian-language document resembling an export licence for the RZ-100 with ministry headers, stamps, and signatures. Supports the text by appearing to provide official documentary evidence of origin and export status.
- search this picture: Google Lens · TinEyeI3 Russian-language document resembling a certificate or licence with official seals and signatures. Supports the text by appearing to provide official documentary evidence.
- search this picture: Google Lens · TinEyeI4 Russian-language document resembling an export licence or certificate with tables and official stamps. Supports the text by appearing to provide official documentary evidence.
Independent news check
| Claim | Finding | Why | Sources |
|---|---|---|---|
| Drone attacks on Moscow occurred around 11–13 November 2026. | real event distorted | Independent outlets in multiple countries report Russian–Ukrainian drone strikes and a mass drone attack on Moscow in that window (Al Jazeera, The Moscow Times, The Kyiv Independent, ABC News, Anadolu Agency, etc.). The event is reported; the posts’ specific framing about the RZ-100 is not confirmed by these outlets. | Q2N1N2N3N4N5N6 |
- Q1 searched “RZ-100 Morok drone Ukraine Moscow attack” (en): 0 articles
- Q2 searched “Ukrainian drone Moscow November 2026” (en):
8 articles
- N1 Al Jazeera: Russia, Ukraine exchange strikes as Baltic nations issue drone alerts (2026-11-11)
- N2 The Moscow Times: Ukrainian Drone Attack Kills Woman, Sparks Fire at Leningrad Region Refinery (2026-11-09)
- N3 ABC News - Breaking News, Latest News and Videos: Ukraine fires nearly 1,200 drones at Russia as US-led talks consider wider European security (2026-11-13)
- N4 Boston Herald: Ukraine launches nearly 1,200 drones at Russia as US-led talks will consider wider European security (2026-11-13)
- N5 The Kyiv Independent: Mass drone attack on Moscow grounds flights at region's airports (2026-11-12)
- N6 The Hill: US envoys meet with Putin in Moscow on Ukraine talks, then see Zelenskyy in Dublin (2026-11-13)
- N7 Sentinel Colorado: US envoys meet with Putin in Moscow on Ukraine talks, then head for Dublin to see Zelenskyy (2026-11-12)
- N8 Anadolu Ajansı: Russia, Ukraine trade accusations over overnight strikes amid US envoys’ visit to Moscow (2026-11-12)
- Q3 searched “PRAT RAMZAI drone manufacturer Ukraine” (en): 0 articles
Evidence-backed claims
nvidia/nemotron-3.5-super-vl-120b-a12b, prompt v6, Sat 14:34 UTC, 3 model calls, 68.7 s · 100% of its references checked against the evidence. Evidence ids: P post, A account, I image, V video, W web page, Q news search, N news article, S FactsLens signal.
Activity per minute
20 minutes, peak 2 posts in one minute.
Signals
| Category | Signal | Value | Threshold | Fired | What it means here |
|---|---|---|---|---|---|
| coordination | copy_paste | 80% | ≥ 50% | yes | 80% of posts repeat near-identical text from another account. |
| coordination | synchrony | 40% | ≥ 50% | no | 40% of the activity happened within a single minute. |
| coordination | repetition | 1.0 | ≥ 2.0 | no | Each account posted this 1.0 times on average. |
| coordination | cross_cluster | 100% | ≥ 50% | yes | 100% of the accounts also appear in at least two other flagged clusters (24 h). |
| account | removed_accounts | 0% | ≥ 20% | no | 0% of the accounts are no longer served by Bluesky (suspended or deleted). |
| account | new_accounts | 100% | ≥ 50% | yes | 100% of the accounts were created in the last 30 days. |
| account | creation_burst | 56% | ≥ 40% | yes | 56% of the accounts were created within the same 72 hours. |
| account | low_reach | 100% | ≥ 60% | yes | 100% of the accounts have fewer than 10 followers. |
| account | empty_profiles | 0% | ≥ 50% | no | 0% of the accounts have no profile picture or no bio. |
| account | template_bios | 0% | ≥ 30% | no | 0% of the accounts have a bio that near-duplicates another account's bio. |
| provenance | known_accounts | 0 | ≥ 1 | no | 0 account(s) are on IFTAS's public list of suspected Portal Kombat accounts. |
| provenance | listed_servers | 50% | ≥ 30% | yes | 50% of the accounts are bridged from Mastodon servers on IFTAS's list. |
| provenance | known_domains | 0 | ≥ 1 | no | Links to 0 domain(s) on VIGINUM/CheckFirst propaganda lists. |
| provenance | pravda_sources | 1 | ≥ 1 | yes | Links to 1 Telegram channel(s) that Pravda sites republish: rybar (a lead, not proof). |
| disclosure | declared_automation | 0% | ≥ 50% | no | 0% of the accounts say in their profile that they are bots or automated feeds. |
| provenance | telegram_first | 4.5 | ≥ 0.0 | yes | The same content appeared first on Telegram (rybar), 4 minutes before the first Bluesky post. |
Recycled pictures
The same picture (perceptual hash) posted by another account with a different caption, in our own data (72 hours). Nemotron says which caption the picture fits; it cannot search the wider web.
- A picture here was posted earlier (Bluesky account, Sat 11:22 → Bluesky account, Sat 18:43). Nemotron: the picture fits neither caption. The earlier caption discusses mobile gaming in Czech, which has no relation to the Russian legal document shown. The later caption discusses a drone attack on Moscow and rebranding of Ukrainian products; while the document is Russian and dated in the relevant timeframe, the visible text does not depict a drone attack, Americans, or product rebranding, so it does not visually support that specific narrative either.
- A picture here was posted earlier (Bluesky account, Sat 11:22 → Bluesky account, Sat 18:24). Nemotron: the picture fits neither caption. The earlier caption is in Czech and discusses mobile gaming, which is unrelated to the Russian bureaucratic document shown. The later caption discusses a drone attack on Moscow and rebranding of Ukrainian developers; while the image is a Russian document, it does not visually depict a drone attack or provide evidence for the claims in the caption. Therefore, neither caption accurately describes the visible content of the picture.
Accounts (10)
Median account age: 9 days. Names are shown only for accounts on IFTAS's public list or already removed by Bluesky; reviewers see all.
| Account | Age (days) | Followers | Follows | Posts here | Status |
|---|---|---|---|---|---|
| t.me/rybar Telegram channel | – | – | – | 1 | public channel |
| account 2 | 9 | 0 | 0 | 1 | active |
| account 3 reviewer: inauthentic (in another cluster) | 9 | 0 | 0 | 1 | active |
| account 4 bridged from Mastodon | 28 | 1 | 0 | 1 | active |
| account 5 | 21 | 1 | 1 | 1 | active |
| account 6 | 4 | 0 | 1 | 1 | active |
| account 7 | 8 | 2 | 1 | 1 | active |
| account 8 bridged from Mastodon | 24 | 1 | 0 | 1 | active |
| account 9 | 7 | 4 | 1 | 1 | active |
| account 10 | 7 | 4 | 1 | 1 | active |
Sample posts from already-public cases
| Time (UTC) | Account | Text |
|---|---|---|
| 14:24:29 | telegram:rybar | 📝Дрон атаковал Москву?📝
американцы его купят
«Смена шильдиков» с украинского на американское/британское происходит все чаще. Для украинских разработчиков любой успех – возможность продать свой товар под видом получения инвестиций, а для Запада – прибрать к рукам готовое к применению оружие, обкатан open
search this picture: Google Lens · TinEyesearch this picture: Google Lens · TinEyesearch this picture: Google Lens · TinEyesearch this picture: Google Lens · TinEye |
Clusters sharing accounts with this one (24 h)
Human review
No human decision yet.
Reviewers can record a decision; decisions feed the public metrics.