Lead review
Suspicious score 35/100 · server cluster · 12 accounts · 36 posts
View in 3D: where it comes from and what it is linked to
First seen Sat 14 Nov 08:25 UTC, last Sun 15 Nov 18:29 UTC. Languages: en 7 Linked: nawitop.ru 4mastodon.social 1flipboard.social 1social.coop 1
Coordinated activity that touches documented propaganda infrastructure.
This is a lead for a human reviewer, not an accusation. Signals are measured; thresholds are starting values evaluated on the metrics page.
Account profiles fetched: 100%.
Nemotron investigation
Insufficient evidence confidence low · recommended: monitor
The cluster does not push a single shared narrative. The ten posts cover unrelated topics: simulation theory and 'Adelaja's' catalogues (P1), commentary on tech giants and privacy (P2), loan-refinance affiliate spam (P3), dating and relationship advice spam with affiliate links (P4-P6), a science and technology RSS repost (P7), and cybersecurity news about a Palantir-UK police contract (P8). The only common element is that all accounts are on the Mastodon server privacysafe.social and were active within one hour on 2026-11-14. The strongest ordinary explanation is a Mastodon server hosting a mix of disclosed automated accounts (A2, A7, A8 self-declare as bots), older organic accounts with real followers (A2: 630 followers, 3,289 posts; A7: 224 followers; A8: 236 followers), and several newly created empty-profile accounts (A3-A6: 78 days old, 0 followers, empty bios, 140-154 posts each) posting spam affiliate links to nawitop.ru. Coordination indicators are mixed: S:creation_burst = 67% (threshold 40%), S:low_reach = 83% (threshold 60%), S:empty_profiles = 83% (threshold 50%), and S:listed_servers = 75% (threshold 30%) are above threshold, but S:copy_paste = 0%, S:repetition = 1.25 (threshold 2.0), and S:cross_cluster = 25% (threshold 50%) show no near-identical messaging or cross-cluster coordination. Because the posts push no shared claim and the pack does not establish that accounts operated together to appear as independent people, the judgment is insufficient_evidence rather than staged or organic.
Narrative: No single shared narrative; unrelated posts about simulation theory/Adelaja's catalogues (P1), tech-giant privacy commentary (P2), loan-refinance affiliate spam (P3), dating/relationship affiliate spam (P4-P6), science/tech RSS repost (P7), and Palantir-UK police contract news (P8). All accounts are on privacysafe.social and active within one hour on 2026-11-14.
Strongest innocent explanation considered: A Mastodon server (privacysafe.social) hosting disclosed bots (A2, A7, A8), older organic accounts with real followers, and several new empty-profile accounts independently posting spam affiliate links to nawitop.ru and scheduled RSS reposts within the same hour.
- S:creation_burst = 67% (threshold 40%), S:low_reach = 83% (threshold 60%), S:empty_profiles = 83% (threshold 50%), S:listed_servers = 75% (threshold 30%) are above threshold
- S:copy_paste = 0%, S:repetition = 1.25 (threshold 2.0), S:cross_cluster = 25% (threshold 50%) show no near-identical messaging or cross-cluster coordination
- Three accounts are old (686-758 days) with substantial post histories and real follower counts; three accounts self-declare automation
- Posts push no shared claim or narrative; they are topically disjointed
- Coordination alone is not proof of inauthenticity
Manipulation techniques
| Technique | Exact words | Why | Post |
|---|---|---|---|
| loaded_language | “shortsighted and stupid” | Characterizes the Palantir deal in dismissive terms. | P8 |
| loaded_language | “addiction” | Frames technology use as addiction. | P2 |
| loaded_language | “handing a monopoly to a handful of tech giants” | Loaded framing of user choices as surrendering independence to monopolies. | P2 |
| loaded_language | “#BREAKINGNEWS” | Hashtag used to inflate the importance of simulation-theory content. | P1 |
Sources
| Domain | Trust | Why |
|---|---|---|
| gab.com | low | Registered 1998-12-08 via Cloudflare, Inc.; age 10203 days Not on VIGINUM/CheckFirst propaganda lists Page is a Gab profile (c_broadcaster) posting Adelaja's collections on US/Israel-Iran war, Trump, and transc-geopolitics, plus links to Gettr and a Wixsite; fringe/partisan platform but not on checked propaganda lists |
| nawitop.ru | low | domain_info returned no registration date or registrar (lookup failed) Not on propaganda lists Pages are affiliate/spam content (loan refinancing, dating advice) with Russian UTM parameters ('сайт знакомств' = dating site); low-quality spam |
| theregister.com | medium | Mainstream technology news outlet; not on propaganda lists Underlying Palantir £10.1M UK police deal confirmed by independent coverage (Q1/N1-N4) |
| framapiaf.org | medium | Mastodon instance; not assessed via domain_info as not central to the narrative |
| mastodon.social | medium | Mastodon instance; not assessed via domain_info as not central to the narrative |
Images and video
Images are blurred: click one to show it. They load from the platform's own servers.
- I1 Illustration of a robot/AI head with a magnifying glass examining a puzzle piece next to a cracked puzzle; generic stock-style imagery that thematically matches the simulation-theory/AI theme of P1 but is not evidence of any specific claim.
- I2 Photo of a blue travel bag/suitcase on a bed with a person in the background; does not clearly support the loan-refinance text of P3; appears generic or mismatched.
- I3 AI-generated portrait of a young woman with pollinations.ai watermark; generic imagery for dating/relationship spam (P4 'ghosting'), does not support any specific factual claim.
- I4 AI-generated portrait of a young woman with pollinations.ai watermark; generic imagery for dating-app spam (P5 'Evening apps check-ins get more matches'), does not support any specific factual claim.
Independent news check
| Claim | Finding | Why | Sources |
|---|---|---|---|
| Palantir won a £10.1M contract with three UK police forces (P8) | real event distorted | search_news (en) returned 4 distinct outlets covering the same event: The Register (2026-11-13), Mezha.net (2026-11-13), PublicTechnology (2026-11-10), and news.lavx.hu (2026-11-13). None are on propaganda lists. Independent outlets report the same event; the posts' framing ('shortsighted and stupid') is opinion, not a distortion of the underlying fact. | Q1N1N2N3N4 |
- Q1 searched “Palantir three UK police forces £10.1 million deal November 2026” (en):
8 articles
- N1 The Register: Palantir adds three UK police forces to its beat with £10.1M deal (2026-11-13)
- N2 Mezha.net: Palantir wins £10.1m contract with three UK police forces (2026-11-13)
- N3 PublicTechnology: Eastern police forces sign £10m Palantir deal to support safeguarding – as reports claim NHS extension planned (2026-11-10)
- N4 news.lavx.hu: Palantir adds three UK police forces to its beat with £10.1 million deal (2026-11-13)
- N5 Mezha.net: GEK TERNA to provide Ukrnafta with gas infrastructure equipment free of charge (2026-11-13)
- N6 news.lavx.hu: OpenAI raises $11 billion at $1.25 trillion valuation, below earlier target (2026-11-08)
- N7 news.lavx.hu: Google adds TPU 8tx and TPU 8i Max to its eighth-generation AI chip lineup (2026-11-13)
- N8 news.lavx.hu: Calley Means turns on the White House, exposing a rift in MAHA (2026-11-10)
Evidence-backed claims
- Palantir adds three UK police forces to its beat with £10.1M deal P8Q1N1N2N3N4
- Independent outlets report the same event; posts add opinion framing ('shortsighted and stupid') but do not distort the underlying fact Q1N1N2N3N4
- Other claims (simulation theory, Adelaja's catalogues, loan-refinance math, dating-app advice) are not verifiable news events; no independent coverage check applies P1P2P3P4P5P6
nvidia/nemotron-3.5-super-vl-120b-a12b, prompt v5, Sat 09:56 UTC, 3 model calls, 59.8 s · 100% of its references checked against the evidence. Evidence ids: P post, A account, I image, V video, W web page, Q news search, N news article, S detector signal.
Activity per minute
60 minutes, peak 2 posts in one minute.
Signals
| Category | Signal | Value | Threshold | Fired | What it means here |
|---|---|---|---|---|---|
| coordination | copy_paste | 15% | ≥ 50% | no | 15% of posts repeat near-identical text from another account. |
| coordination | synchrony | 22% | ≥ 50% | no | 22% of the activity happened within a single minute. |
| coordination | repetition | 3.0 | ≥ 2.0 | yes | Each account posted this 3.0 times on average. |
| coordination | cross_cluster | 21% | ≥ 50% | no | 21% of the accounts also appear in at least two other flagged clusters (24 h). |
| account | removed_accounts | 0% | ≥ 20% | no | 0% of the accounts are no longer served by Bluesky (suspended or deleted). |
| account | new_accounts | 0% | ≥ 50% | no | 0% of the accounts were created in the last 30 days. |
| account | creation_burst | 21% | ≥ 40% | no | 21% of the accounts were created within the same 72 hours. |
| account | low_reach | 42% | ≥ 60% | no | 42% of the accounts have fewer than 10 followers. |
| account | empty_profiles | 32% | ≥ 50% | no | 32% of the accounts have no profile picture or no bio. |
| account | template_bios | 0% | ≥ 30% | no | 0% of the accounts have a bio that near-duplicates another account's bio. |
| provenance | known_accounts | 0 | ≥ 1 | no | 0 account(s) are on IFTAS's public list of suspected Portal Kombat accounts. |
| provenance | listed_servers | 100% | ≥ 30% | yes | 100% of the accounts are bridged from Mastodon servers on IFTAS's list. |
| provenance | known_domains | 0 | ≥ 1 | no | Links to 0 domain(s) on VIGINUM/CheckFirst propaganda lists. |
| provenance | pravda_sources | 0 | ≥ 1 | no | Links to 0 Telegram channel(s) that Pravda sites republish (a lead, not proof). |
| disclosure | declared_automation | 53% | ≥ 50% | yes | 53% of the accounts say in their profile that they are bots or automated feeds. |
Recycled pictures
The same picture (perceptual hash) posted by another account with a different caption, in our own data (72 hours). Nemotron says which caption the picture fits; it cannot search the wider web.
- A picture here was posted earlier (Mastodon account on truthsocial.co.in, Sun 00:38 → Mastodon account on privacysafe.social, Sun 11:58). Nemotron: the picture fits the earlier caption, not the later one. The later caption describes a video chat before a first date, but the image shows an in-person meeting with no video-chat equipment visible, so it contradicts the later caption. The earlier caption concerns an in-person dating context (date three), which is consistent with two people physically together on a date, though the image does not confirm it is specifically date three or that they are discussing non-negotiables.
- A picture here was posted earlier (Mastodon account on truthsocial.co.in, Sat 18:00 → Mastodon account on privacysafe.social, Sun 11:57). Nemotron: the picture fits neither caption. The picture shows only a split-style illustrated portrait. It contains no visual content matching the earlier caption about exchange accounts, self-custody, trading desks, or crypto, and no visual content matching the later caption about first dates, dating questions, or relationships. Place and time cannot be determined from the image; the backgrounds are nondescript and there are no clocks, dates, or geographic indicators.
- A picture here was posted earlier (Mastodon account on truthsocial.co.in, Sat 13:52 → Mastodon account on privacysafe.social, Sun 01:58). Nemotron: the picture fits the earlier caption, not the later one. The house model and financial-looking documents align with the earlier caption about savings accounts, emergency funds, and finance. The image contains no elements related to dating, ramen, or relationships, so it does not fit the later caption.
- A picture here was posted earlier (Mastodon account on truthsocial.co.in, Sat 13:52 → Mastodon account on privacysafe.social, Sat 23:40). Nemotron: the picture fits neither caption. The picture depicts a house model and documents, which is thematically related to real estate or housing paperwork. It does not visibly show high-yield savings accounts, banks, emergency funds, or money transfers (earlier caption), nor does it show dating, people, or any relationship context (later caption). Therefore it fits neither caption specifically.
- A picture here was posted earlier (Mastodon account on truthsocial.co.in, Sat 21:02 → Mastodon account on privacysafe.social, Sat 23:40). Nemotron: the picture fits neither caption. The earlier caption discusses crypto trading, cash, and market discounts, but nothing in the image relates to trading, finance, or markets. The later caption describes a profile photo of someone genuinely laughing, but the person in the image has a neutral expression and appears to be working, not posing for a dating profile. Therefore, the image fits neither caption.
- A picture here was posted earlier (Mastodon account on truthsocial.co.in, Sat 17:14 → Mastodon account on privacysafe.social, Sat 19:50). Nemotron: the picture fits neither caption. Neither caption describes the visual content of the image. The captions contain specific financial advice, URLs, and hashtags, none of which appear on the phone screens or elsewhere in the image. The image is a generic photo of devices displaying an interface, not a screenshot of the specific posts mentioned.
- A picture here was posted earlier (Mastodon account on truthsocial.co.in, Sat 11:32 → Mastodon account on privacysafe.social, Sat 19:49). Nemotron: the picture fits the later caption. The image fits the later caption better because the desk setting with papers and a laptop aligns with the theme of finance or budgeting discussed in the text. The earlier caption discusses dating profile photos; while the image is a clear shot of a single person without sunglasses, the context of sitting at a desk with work materials does not specifically illustrate dating advice.
- A picture here was posted earlier (Mastodon account on privacysafe.social, Sat 17:11 → Mastodon account on privacysafe.social, Sat 18:49). Nemotron: the picture fits neither caption. The picture does not visibly depict a ramen place, a date, people meeting, dating-app matches, or any of the specific scenarios described in either caption. While the clock thematically evokes “time” or “timing,” which both captions mention metaphorically, the image itself contains no visual evidence tying it specifically to the earlier caption, the later caption, or both. Therefore it fits neither caption based on visible content.
- A picture here was posted earlier (Mastodon account on truthsocial.co.in, Sat 10:44 → Mastodon account on privacysafe.social, Sat 18:49). Nemotron: the picture fits the earlier caption, not the later one. The earlier caption concerns trading, leverage, and financial risk, which thematically aligns with casino chips/gambling imagery. The later caption concerns travel photos and dating profiles, which has no visible connection to the image. However, neither caption directly describes the visible content (casino tokens), so the fit is thematic rather than literal.
- A picture here was posted earlier (Mastodon account on truthsocial.co.in, Sat 10:33 → Mastodon account on privacysafe.social, Sat 15:50). Nemotron: the picture fits neither caption. The image is a generic portrait that does not visually depict dating apps, messages, profiles, or specific interests mentioned in either caption. It could generically illustrate either topic, but contains no specific visual clues to link it to one caption over the other.
Accounts (19)
Median account age: 226 days. Names are shown only for accounts on IFTAS's public list or already removed by Bluesky; the team sees all.
| Account | Age (days) | Followers | Follows | Posts here | Status |
|---|---|---|---|---|---|
| account 1 | 74 | 3 | 4 | 1 | active |
| account 2 | 706 | 631 | 58 | 5 | active |
| account 3 | 79 | 0 | 0 | 3 | active |
| account 4 | 79 | 0 | 0 | 3 | active |
| account 5 | 79 | 0 | 0 | 3 | active |
| account 6 | 79 | 0 | 0 | 3 | active |
| account 7 | 687 | 224 | 48 | 2 | active |
| account 8 | 759 | 236 | 75 | 3 | active |
| account 9 | 687 | 959 | 309 | 1 | active |
| account 10 | 71 | 0 | 0 | 1 | active |
| account 11 | 714 | 3157 | 61 | 1 | active |
| account 12 | 145 | 33 | 13 | 2 | active |
| account 13 | 416 | 20 | 19 | 9 | active |
| account 14 | 226 | 8 | 9 | 1 | active |
| account 15 | 226 | 12 | 1 | 1 | active |
| account 16 | 235 | 46 | 6 | 2 | active |
| account 17 | 713 | 145 | 29 | 1 | active |
| account 18 | 235 | 5 | 0 | 1 | active |
| account 19 | 109 | 165 | 147 | 1 | active |
Clusters sharing accounts with this one (24 h)
| Tier | Kind | Shared message or link | Shared accounts |
|---|---|---|---|
| Suspicious | hashtag | #finance #investing #money #stocks | 4 |
| Suspicious | hashtag | #dating #love #onlinedating #relationships | 4 |
| Suspicious | domain | nawitop.ru | 4 |
Human review
No human decision yet.
Anyone can review. Your decision is kept with the visitors' reviews, apart from our own figures. Decide with the bar at the bottom of the screen; it moves on to the next cluster nobody has reviewed.