Lead review
Suspicious score 70/100 · text cluster · 5 accounts · 6 posts
View in 3D: where it comes from and what it is linked to
Part of a campaign: FactsLens coordinated activity report — Bluesky templated solicitation network (40 clusters, 25 accounts), linked by Nemotron.
First seen Sat 14 Nov 09:13 UTC, last Sat 14 Nov 09:21 UTC.
Coordinated activity by accounts with several signs of being inauthentic.
This is a lead for a human reviewer, not an accusation. Signals are measured; thresholds are starting values evaluated on the metrics page.
Account profiles fetched: 100%.
Nemotron investigation
Insufficient evidence confidence high · recommended: human review
Four anonymized Bluesky accounts posted near-identical begging appeals within four minutes, each addressing a different recipient by name while using the same body text. The accounts show empty profiles, low reach, a creation burst, and cross-cluster appearance, indicating coordinated inauthentic behavior rather than independent personal pleas.
Narrative: A generic personal begging appeal asking an individual to help the poster's family survive, personalized only by swapping the recipient's name in the greeting. No specific crisis, location, cause, or verifiable event is named.
Strongest innocent explanation considered: A copy-paste begging or scam template in which several accounts post the same wording with only the addressee's name changed, likely to solicit money or sympathy. Four unrelated people independently choosing identical wording and posting within minutes is possible but unlikely.
- S:copy_paste = 100% (threshold 50%): all four posts repeat near-identical text from another account (P1-P4)
- S:synchrony = 50% (threshold 50%): half the activity occurred within a single minute; all four posts span only four minutes (P1-P4)
- S:creation_burst = 50% (threshold 40%): A2 (802 days old) and A3 (799 days old) were created within days of each other
- S:empty_profiles = 100% (threshold 50%): all accounts lack a profile picture and bio (A1-A4)
- S:low_reach = 50% (threshold 60%): A1 has 14 followers and A4 has 0 followers, both under 10 followers (A1, A4)
- No grounded claim supports 'staged'.
Manipulation techniques
| Technique | Exact words | Why | Post |
|---|---|---|---|
| fear_appeal | “Please help my family survive.🙏” | Invokes fear of death or harm to the poster's family to create urgency and pressure the recipient to act. | P1 |
| loaded_language | “survive” | Frames the situation as life-or-death and casts the addressee as responsible for the family's survival. | P1 |
| other | “Hi Nacho” | False personal connection: each post addresses a different individual by name while the body text is identical across accounts, mimicking a genuine private plea. | P1 |
| other | “Hi Ravencrest” | False personal connection: each post addresses a different individual by name while the body text is identical across accounts, mimicking a genuine private plea. | P2 |
| other | “Hi Ozgur” | False personal connection: each post addresses a different individual by name while the body text is identical across accounts, mimicking a genuine private plea. | P3 |
| other | “Hi Sydney” | False personal connection: each post addresses a different individual by name while the body text is identical across accounts, mimicking a genuine private plea. | P4 |
Independent news check
| Claim | Finding | Why | Sources |
|---|---|---|---|
| not checked | The posts make no specific verifiable factual claim (no named event, place, date, or incident); 'help my family survive' is a generic unverifiable appeal, so there is nothing concrete to search for in independent news coverage. |
nvidia/nemotron-3.5-super-vl-120b-a12b, prompt v4, Sat 09:18 UTC, 2 model calls, 41.4 s · 100% of its references checked against the evidence. Evidence ids: P post, A account, I image, V video, W web page, Q news search, N news article, S FactsLens signal.
Activity per minute
9 minutes, peak 2 posts in one minute.
Signals
| Category | Signal | Value | Threshold | Fired | What it means here |
|---|---|---|---|---|---|
| coordination | copy_paste | 100% | ≥ 50% | yes | 100% of posts repeat near-identical text from another account. |
| coordination | synchrony | 33% | ≥ 50% | no | 33% of the activity happened within a single minute. |
| coordination | repetition | 1.2 | ≥ 2.0 | no | Each account posted this 1.2 times on average. |
| coordination | cross_cluster | 100% | ≥ 50% | yes | 100% of the accounts also appear in at least two other flagged clusters (24 h). |
| account | removed_accounts | 0% | ≥ 20% | no | 0% of the accounts are no longer served by Bluesky (suspended or deleted). |
| account | new_accounts | 0% | ≥ 50% | no | 0% of the accounts were created in the last 30 days. |
| account | creation_burst | 60% | ≥ 40% | yes | 60% of the accounts were created within the same 72 hours. |
| account | low_reach | 60% | ≥ 60% | yes | 60% of the accounts have fewer than 10 followers. |
| account | empty_profiles | 100% | ≥ 50% | yes | 100% of the accounts have no profile picture or no bio. |
| account | template_bios | 0% | ≥ 30% | no | 0% of the accounts have a bio that near-duplicates another account's bio. |
| provenance | known_accounts | 0 | ≥ 1 | no | 0 account(s) are on IFTAS's public list of suspected Portal Kombat accounts. |
| provenance | listed_servers | 0% | ≥ 30% | no | 0% of the accounts are bridged from Mastodon servers on IFTAS's list. |
| provenance | known_domains | 0 | ≥ 1 | no | Links to 0 domain(s) on VIGINUM/CheckFirst propaganda lists. |
| provenance | pravda_sources | 0 | ≥ 1 | no | Links to 0 Telegram channel(s) that Pravda sites republish (a lead, not proof). |
| disclosure | declared_automation | 0% | ≥ 50% | no | 0% of the accounts say in their profile that they are bots or automated feeds. |
Accounts (5)
Median account age: 799 days. Names are shown only for accounts on IFTAS's public list or already removed by Bluesky; reviewers see all.
| Account | Age (days) | Followers | Follows | Posts here | Status |
|---|---|---|---|---|---|
| account 1 | 222 | 14 | 8 | 2 | active |
| account 2 | 802 | 15 | 15 | 1 | active |
| account 3 | 799 | 9 | 11 | 1 | active |
| account 4 | 726 | 0 | 1 | 1 | active |
| account 5 | 802 | 6 | 8 | 1 | active |
Clusters sharing accounts with this one (24 h)
| Tier | Kind | Shared message or link | Shared accounts |
|---|---|---|---|
| Suspicious | text | Hi Learning, Please consider helping us. | 4 |
| Suspicious | text | Hi Joe, Please share or doante to help us. | 4 |
| Suspicious | text | Hi Ross, Please share or doante to help us. | 4 |
| Suspicious | text | Hi Onikuno, Please share or doante to help us. | 4 |
| Suspicious | text | Hi clunse, Please support our fundraiser.🙏 | 4 |
| Watch | text | Hi Ginger, Please help my family survive.🙏 | 4 |
| Suspicious | text | Hi shutupjab, Please help my family survive.🙏 | 4 |
| Suspicious | text | Hi Robert, Please share or doante to help us. | 3 |
| Suspicious | text | Hi atchill, Please help my little ones.🙏 | 3 |
| Suspicious | text | Hi Jason, Please share or doante to help us. | 3 |
| Suspicious | text | Hi Blue, Please help my family survive.🙏 | 3 |
| Suspicious | text | Hi Hermine, Please support our fundraiser.🙏 | 3 |
Human review
- Sat 12:57 UTC: Confirmed: Bot network / fake amplification (FactsLens said Suspicious, Nemotron said Insufficient evidence)
Reviewers can record a decision; decisions feed the public metrics.