Lead review
Suspicious score 50/100 · text cluster · 6 accounts · 6 posts
View in 3D: where it comes from and what it is linked to
Part of a campaign: FactsLens coordinated activity report — Bluesky templated solicitation network (40 clusters, 25 accounts), linked by Nemotron.
First seen Sat 14 Nov 10:12 UTC, last Sat 14 Nov 10:16 UTC.
Coordinated activity by accounts with several signs of being inauthentic.
This is a lead for a human reviewer, not an accusation. Signals are measured; thresholds are starting values evaluated on the metrics page.
Account profiles fetched: 100%.
Nemotron investigation
Insufficient evidence confidence low · recommended: monitor
Four Bluesky accounts posted near-identical short messages asking a named individual ('Matt', 'Attitude', 'Adam', 'Fuzuki') to 'support our fundraiser' with a praying-hands emoji. No fundraiser, organizer, link, or further details are provided; only the addressee's name varies between posts.
Narrative: Four Bluesky accounts posted near-identical short messages asking a named individual ('Matt', 'Attitude', 'Adam', 'Fuzuki') to 'support our fundraiser' with a praying-hands emoji. No fundraiser, organizer, link, or further details are provided; only the addressee's name varies between posts.
Strongest innocent explanation considered: A fundraiser organizer or a person using several accounts asked specific contacts to support a fundraiser, using a shared template with the recipient's name swapped in.
- The cluster shows coordination indicators: 100% near-identical copy-paste text (S:copy_paste = 100%), half the activity within one minute (S:synchrony = 50%), empty profiles and minimal reach on all accounts (S:empty_profiles = 100%, S:low_reach = 100%), and 75% of accounts appearing in other flagged clusters (S:cross_cluster = 75%).
- However, all accounts are aged (560-799 days old), none are declared automation (S:declared_automation = 0%), none appear on known inauthentic-behavior lists (S:known_accounts = 0, S:listed_servers = 0%), no propaganda domains are linked (S:known_domains = 0), none are suspended or deleted (S:removed_accounts = 0%), and each account has some followers and followees (A1-A4).
- The personalized greetings could reflect genuine outreach to specific contacts or a template used by one operator; the evidence does not distinguish these. Coordination alone is not proof of inauthenticity.
nvidia/nemotron-3.5-super-vl-120b-a12b, prompt v5, Sat 10:15 UTC, 2 model calls, 36.3 s · 100% of its references checked against the evidence. Evidence ids: P post, A account, I image, V video, W web page, Q news search, N news article, S FactsLens signal.
Activity per minute
5 minutes, peak 2 posts in one minute.
Signals
| Category | Signal | Value | Threshold | Fired | What it means here |
|---|---|---|---|---|---|
| coordination | copy_paste | 100% | ≥ 50% | yes | 100% of posts repeat near-identical text from another account. |
| coordination | synchrony | 33% | ≥ 50% | no | 33% of the activity happened within a single minute. |
| coordination | repetition | 1.0 | ≥ 2.0 | no | Each account posted this 1.0 times on average. |
| coordination | cross_cluster | 83% | ≥ 50% | yes | 83% of the accounts also appear in at least two other flagged clusters (24 h). |
| account | removed_accounts | 0% | ≥ 20% | no | 0% of the accounts are no longer served by Bluesky (suspended or deleted). |
| account | new_accounts | 0% | ≥ 50% | no | 0% of the accounts were created in the last 30 days. |
| account | creation_burst | 33% | ≥ 40% | no | 33% of the accounts were created within the same 72 hours. |
| account | low_reach | 100% | ≥ 60% | yes | 100% of the accounts have fewer than 10 followers. |
| account | empty_profiles | 100% | ≥ 50% | yes | 100% of the accounts have no profile picture or no bio. |
| account | template_bios | 0% | ≥ 30% | no | 0% of the accounts have a bio that near-duplicates another account's bio. |
| provenance | known_accounts | 0 | ≥ 1 | no | 0 account(s) are on IFTAS's public list of suspected Portal Kombat accounts. |
| provenance | listed_servers | 0% | ≥ 30% | no | 0% of the accounts are bridged from Mastodon servers on IFTAS's list. |
| provenance | known_domains | 0 | ≥ 1 | no | Links to 0 domain(s) on VIGINUM/CheckFirst propaganda lists. |
| provenance | pravda_sources | 0 | ≥ 1 | no | Links to 0 Telegram channel(s) that Pravda sites republish (a lead, not proof). |
| disclosure | declared_automation | 0% | ≥ 50% | no | 0% of the accounts say in their profile that they are bots or automated feeds. |
Accounts (6)
Median account age: 795 days. Names are shown only for accounts on IFTAS's public list or already removed by Bluesky; reviewers see all.
| Account | Age (days) | Followers | Follows | Posts here | Status |
|---|---|---|---|---|---|
| account 1 | 780 | 1 | 1 | 1 | active |
| account 2 | 795 | 4 | 4 | 1 | active |
| account 3 | 799 | 9 | 11 | 1 | active |
| account 4 | 560 | 3 | 2 | 1 | active |
| account 5 | 794 | 5 | 6 | 1 | active |
| account 6 | 804 | 1 | 1 | 1 | active |
Clusters sharing accounts with this one (24 h)
| Tier | Kind | Shared message or link | Shared accounts |
|---|---|---|---|
| Suspicious | text | Hi ROC, Please share or doante to help us. | 5 |
| Suspicious | text | Hi Hermine, Please support our fundraiser.🙏 | 5 |
| Suspicious | text | Hi Tracey, Please help my family survive.🙏 | 4 |
| Suspicious | text | Hi Blue, Please help my family survive.🙏 | 4 |
| Suspicious | text | Hi sane, Please share or doante to help us. | 4 |
| Suspicious | text | Hi Robert, Please share or doante to help us. | 4 |
| Suspicious | text | Hi rene, Please help my family survive.🙏 | 4 |
| Suspicious | text | Hi Claude, Please help my family survive.🙏 | 4 |
| Suspicious | text | Hi Penndred, Please share or doante to help us. | 4 |
| Suspicious | text | Hi atchill, Please help my little ones.🙏 | 3 |
| Suspicious | text | Hi Deanna, Can you support my children?🙏 | 3 |
| Suspicious | text | Hi Jason, Please share or doante to help us. | 3 |
Human review
No human decision yet.
Reviewers can record a decision; decisions feed the public metrics.