Lead review
Suspicious score 70/100 · text cluster · 4 accounts · 4 posts
View in 3D: where it comes from and what it is linked to
Part of a campaign: FactsLens campaign report (40 clusters, 23 accounts), linked by Nemotron.
First seen Sat 14 Nov 15:37 UTC, last Sat 14 Nov 16:17 UTC. Languages: ar 4
Coordinated activity by accounts with several signs of being inauthentic.
This is a lead for a human reviewer, not an accusation. Signals are measured; thresholds are starting values evaluated on the metrics page.
Account profiles fetched: 100%.
Nemotron investigation
Staged confidence high · recommended: human review
Four Bluesky accounts posted near-identical donation appeals claiming a 5-year-old son named Mohammed was injured in Gaza and needed care, empathy, donations, and shares. The text promised a link on each account's page but included no link. Each post named a different 'friend' (Christina, Dave, Charlie) while all four claimed the same child as 'my son.' Measurements show 100% copy-paste, cross-cluster overlap on all accounts, a creation burst affecting half the accounts, one brand-new account, and all accounts having under 10 followers and empty profiles. Independent news searches in Arabic and English found no coverage of a specific child named Mohammed matching this appeal; one English result concerned meningitis among Gaza children generally and did not corroborate the specific claim. The evidence indicates a coordinated inauthentic donation-scam network rather than independent users.
Narrative: A personal charity appeal: each account says its 5-year-old son Mohammed was injured in Gaza, needs real medical care, and asks readers for empathy, donations, and shares, claiming 'His story and link are on my page.' The only variation is the name of a 'friend' prefixed to the text. No link, image, or video is actually attached.
Strongest innocent explanation considered: Independent individuals who sympathize with children injured in Gaza independently wrote and posted nearly identical pleas for donations, or a small group of supporters sharing the same fundraising appeal through a share button.
- :copy_paste = 100%: all four posts repeat near-identical text; only the 'friend' name changes (Christina, Dave, Charlie) [P1][P2][P3][P4]
- Contradictory personal claims: each account says 'My son Mohammed,' but four different people cannot all be the parent of the same child [P1][P2][P3][P4]
- Missing link: the text promises 'His story and link are on my page,' but no link appears in any post [P1][P2][P3][P4]
- S:cross_cluster = 100%: all accounts also appear in at least two other flagged clusters within 24 h
- S:creation_burst = 50%: half the accounts were created within the same 72 hours; A3 is only 9 days old [A3][A4][A1][A2] creation dates in pack evidence pack account list (A1 801 days, A2 724 days, A3 9 days, A4 804 days ago)
Manipulation techniques
| Technique | Exact words | Why | Post |
|---|---|---|---|
| fear_appeal | “His injury in Gaza needs real care” | Invokes fear for a wounded child to pressure readers into donating and sharing. | P1 |
| loaded_language | “I need your empathy, your donation, your share” | Emotionally charged, urgent demand framing the reader's response as obligatory. | P1 |
Sources
| Domain | Trust | Why |
|---|---|---|
| none | unknown | No web pages were linked in any post, despite the text claiming 'His story and link are on my page' [P1][P2][P3][P4]. There is therefore no domain to assess for age, registrar, propaganda-list appearance, or source concealment. The absence of a promised link is itself a red flag typical of scam posts. |
Independent news check
| Claim | Finding | Why | Sources |
|---|---|---|---|
| A 5-year-old boy named Mohammed was injured in Gaza and needs donations. | not checked | No independent outlet covers this specific claim. Arabic search returned no articles [Q1]. English search returned one article about meningitis among Gaza children generally [N1], which does not corroborate a specific child named Mohammed or a donation appeal [N1]. Finding no coverage is weak evidence; combined with the template structure and contradictions it supports the staged assessment. The news check does not decide the verdict on its own. | Q1Q2N1 |
- Q1 searched “محمد طفل غزة إصابة تبرعات” (en): 0 articles
- Q2 searched “Mohammed five years old Gaza injury donation” (en):
1 articles
- N1 Facebook: MENINGITIS SPREADS AMONG CHILDREN IN GAZA Overcrowded hospitals and displacement camps are contributing to the spread of meningitis among children in Gaza. #DWNews (2026-11-09)
Evidence-backed claims
- A 5-year-old boy named Mohammed was injured in Gaza and needs donations/care. P1P2P3P4Q1Q2N1Q2
- Independent coverage check Q1Q2N1
- Arabic search for محمد طفل غزة إصابة تبرعات returned no articles [Q1]. English search for 'Mohammed five years old Gaza injury donation' returned one article about meningitis spreading among children in Gaza generally [N1], not about a specific child named Mohammed or a donation appeal [N1]. No independent outlet corroborates the specific claim; absence of coverage is weak evidence but consistent with a fabricated appeal. Q1Q2N1
nvidia/nemotron-3.5-super-vl-120b-a12b, prompt v6, Sat 19:16 UTC, 3 model calls, 54.8 s · 100% of its references checked against the evidence. Evidence ids: P post, A account, I image, V video, W web page, Q news search, N news article, S FactsLens signal.
Activity per minute
41 minutes, peak 1 posts in one minute.
Signals
| Category | Signal | Value | Threshold | Fired | What it means here |
|---|---|---|---|---|---|
| coordination | copy_paste | 100% | ≥ 50% | yes | 100% of posts repeat near-identical text from another account. |
| coordination | synchrony | 25% | ≥ 50% | no | 25% of the activity happened within a single minute. |
| coordination | repetition | 1.0 | ≥ 2.0 | no | Each account posted this 1.0 times on average. |
| coordination | cross_cluster | 100% | ≥ 50% | yes | 100% of the accounts also appear in at least two other flagged clusters (24 h). |
| account | removed_accounts | 0% | ≥ 20% | no | 0% of the accounts are no longer served by Bluesky (suspended or deleted). |
| account | new_accounts | 25% | ≥ 50% | no | 25% of the accounts were created in the last 30 days. |
| account | creation_burst | 50% | ≥ 40% | yes | 50% of the accounts were created within the same 72 hours. |
| account | low_reach | 100% | ≥ 60% | yes | 100% of the accounts have fewer than 10 followers. |
| account | empty_profiles | 100% | ≥ 50% | yes | 100% of the accounts have no profile picture or no bio. |
| account | template_bios | 0% | ≥ 30% | no | 0% of the accounts have a bio that near-duplicates another account's bio. |
| provenance | known_accounts | 0 | ≥ 1 | no | 0 account(s) are on IFTAS's public list of suspected Portal Kombat accounts. |
| provenance | listed_servers | 0% | ≥ 30% | no | 0% of the accounts are bridged from Mastodon servers on IFTAS's list. |
| provenance | known_domains | 0 | ≥ 1 | no | Links to 0 domain(s) on VIGINUM/CheckFirst propaganda lists. |
| provenance | pravda_sources | 0 | ≥ 1 | no | Links to 0 Telegram channel(s) that Pravda sites republish (a lead, not proof). |
| disclosure | declared_automation | 0% | ≥ 50% | no | 0% of the accounts say in their profile that they are bots or automated feeds. |
Accounts (4)
Median account age: 801 days. Names are shown only for accounts on IFTAS's public list or already removed by Bluesky; reviewers see all.
| Account | Age (days) | Followers | Follows | Posts here | Status |
|---|---|---|---|---|---|
| account 1 | 801 | 0 | 35 | 1 | active |
| account 2 | 724 | 5 | 6 | 1 | active |
| account 3 | 9 | 0 | 4 | 1 | active |
| account 4 | 804 | 2 | 143 | 1 | active |
Clusters sharing accounts with this one (24 h)
Human review
No human decision yet.
Reviewers can record a decision; decisions feed the public metrics.