Lead review
Suspicious score 60/100 · text cluster · 12 accounts · 28 posts
View in 3D: where it comes from and what it is linked to
Part of a campaign: FactsLens coordinated activity report — Bluesky templated solicitation network (40 clusters, 25 accounts), linked by Nemotron.
First seen Sat 14 Nov 09:23 UTC, last Sat 14 Nov 09:47 UTC.
Coordinated activity by accounts with several signs of being inauthentic.
This is a lead for a human reviewer, not an accusation. Signals are measured; thresholds are starting values evaluated on the metrics page.
Account profiles fetched: 100%.
Nemotron investigation
Insufficient evidence confidence medium · recommended: human review
Twelve Bluesky accounts posted near-identical text of the form "Hi [name], Please help my family survive.�end", each addressing a different first name. No links, images, or videos were attached. The cluster shows strong coordination signals: 100% copy-paste, 100% empty profiles (no avatar, no bio), 100% of accounts also appearing in at least two other flagged clusters, 67% low reach, and 25% account creation within the same 72 hours. No account declares automation. Judgment: staged (moderate confidence).
Narrative: A generic, personalized appeal claiming the poster's family is in danger and needs help to survive, sent as a direct one-to-one message to different named recipients.
Strongest innocent explanation considered: One operator or small group copy-pasting a begging/scam template across multiple accounts, swapping names to simulate independent personal pleas; alternatively, unrelated individuals coincidentally using identical phrasing (implausible given 100% copy-paste and uniformly empty profiles).
- S:copy_paste = 100% (threshold 50%): all posts repeat near-identical text
- S:empty_profiles = 100% (threshold 50%): no avatar or bio on any account
- S:cross_cluster = 100% (threshold 50%): all accounts appear in at least two other flagged clusters
- S:low_reach = 67% (threshold 60%): most accounts have fewer than 10 followers
- S:creation_burst = 25%: a quarter of accounts created within the same 72 hours
- No grounded claim supports 'staged'.
Manipulation techniques
| Technique | Exact words | Why | Post |
|---|---|---|---|
| fear_appeal | “Please help my family survive.🙏” | Invokes fear for the safety of the poster's family to pressure the recipient. | P1 |
| other | “Hi shutupjab, Please help my family survive.🙏” | Template personalization: inserting different names into an identical message to mimic independent, one-to-one appeals. | P1 |
| other | “Hi Pierre, Please help my family survive.🙏” | Template personalization with a different name. | P2 |
| other | “Hi Erin, Please help my family survive.🙏” | Template personalization with a different name. | P3 |
| other | “Hi Dumple, Please help my family survive.🙏” | Template personalization with a different name. | P4 |
| other | “Hi Milady, Please help my family survive.🙏” | Template personalization with a different name. | P5 |
Sources
| Domain | Trust | Why |
|---|---|---|
| none | unknown | No web pages were shared in this cluster (Linked web pages: none). |
Independent news check
| Claim | Finding | Why | Sources |
|---|---|---|---|
| None verifiable | not checked | Posts contain no specific verifiable factual claim (no event, place, or incident); only a generic unverifiable appeal. Skipped per guidance for content with no factual claim. |
nvidia/nemotron-3.5-super-vl-120b-a12b, prompt v5, Sat 09:59 UTC, 2 model calls, 41.2 s · 100% of its references checked against the evidence. Evidence ids: P post, A account, I image, V video, W web page, Q news search, N news article, S FactsLens signal.
Activity per minute
25 minutes, peak 3 posts in one minute.
Signals
| Category | Signal | Value | Threshold | Fired | What it means here |
|---|---|---|---|---|---|
| coordination | copy_paste | 100% | ≥ 50% | yes | 100% of posts repeat near-identical text from another account. |
| coordination | synchrony | 11% | ≥ 50% | no | 11% of the activity happened within a single minute. |
| coordination | repetition | 2.33 | ≥ 2.0 | yes | Each account posted this 2.3 times on average. |
| coordination | cross_cluster | 100% | ≥ 50% | yes | 100% of the accounts also appear in at least two other flagged clusters (24 h). |
| account | removed_accounts | 0% | ≥ 20% | no | 0% of the accounts are no longer served by Bluesky (suspended or deleted). |
| account | new_accounts | 0% | ≥ 50% | no | 0% of the accounts were created in the last 30 days. |
| account | creation_burst | 25% | ≥ 40% | no | 25% of the accounts were created within the same 72 hours. |
| account | low_reach | 67% | ≥ 60% | yes | 67% of the accounts have fewer than 10 followers. |
| account | empty_profiles | 100% | ≥ 50% | yes | 100% of the accounts have no profile picture or no bio. |
| account | template_bios | 0% | ≥ 30% | no | 0% of the accounts have a bio that near-duplicates another account's bio. |
| provenance | known_accounts | 0 | ≥ 1 | no | 0 account(s) are on IFTAS's public list of suspected Portal Kombat accounts. |
| provenance | listed_servers | 0% | ≥ 30% | no | 0% of the accounts are bridged from Mastodon servers on IFTAS's list. |
| provenance | known_domains | 0 | ≥ 1 | no | Links to 0 domain(s) on VIGINUM/CheckFirst propaganda lists. |
| provenance | pravda_sources | 0 | ≥ 1 | no | Links to 0 Telegram channel(s) that Pravda sites republish (a lead, not proof). |
| disclosure | declared_automation | 0% | ≥ 50% | no | 0% of the accounts say in their profile that they are bots or automated feeds. |
Accounts (12)
Median account age: 793 days. Names are shown only for accounts on IFTAS's public list or already removed by Bluesky; reviewers see all.
| Account | Age (days) | Followers | Follows | Posts here | Status |
|---|---|---|---|---|---|
| account 1 | 777 | 5 | 6 | 3 | active |
| account 2 | 345 | 0 | 2 | 1 | active |
| account 3 | 802 | 6 | 8 | 2 | active |
| account 4 | 560 | 3 | 2 | 6 | active |
| account 5 | 222 | 14 | 8 | 1 | active |
| account 6 | 793 | 1 | 1 | 3 | active |
| account 7 | 799 | 9 | 11 | 2 | active |
| account 8 | 790 | 16 | 12 | 3 | active |
| account 9 | 804 | 1 | 1 | 2 | active |
| account 10 | 584 | 40 | 7 | 3 | active |
| account 11 | 799 | 2 | 2 | 1 | active |
| account 12 | 802 | 15 | 15 | 1 | active |
Clusters sharing accounts with this one (24 h)
| Tier | Kind | Shared message or link | Shared accounts |
|---|---|---|---|
| Suspicious | text | Hi Ross, Please share or doante to help us. | 11 |
| Watch | text | Hi Ginger, Please help my family survive.🙏 | 10 |
| Suspicious | text | Hi Joe, Please share or doante to help us. | 10 |
| Suspicious | text | Hi Yamikuri, Please support our fundraiser.🙏 | 9 |
| Suspicious | text | Hi Hermine, Please support our fundraiser.🙏 | 9 |
| Suspicious | text | Hi Onikuno, Please share or doante to help us. | 9 |
| Suspicious | text | Hi Learning, Please consider helping us. | 9 |
| Suspicious | text | Hi clunse, Please support our fundraiser.🙏 | 9 |
| Suspicious | text | Hi Blue, Please help my family survive.🙏 | 8 |
| Suspicious | text | Hi Penndred, Please share or doante to help us. | 7 |
| Suspicious | text | Hi atchill, Please help my little ones.🙏 | 7 |
| Suspicious | text | Hi Robert, Please share or doante to help us. | 6 |
Human review
No human decision yet.
Reviewers can record a decision; decisions feed the public metrics.