Section C
The Network
Groups of accounts acting together on Bluesky, Mastodon and Telegram in the last
72 hours: what they push, how we caught them, and where they come from. A group is a lead for people to
check, never a verdict; account names appear only for cases already on public lists.
On our topics: war, Russia and Ukraine, NATO, the EU, the Baltics and Finland
Suspicious · 4 accounts
the same text · last seen Sat 19:40 UTC
- 100% of posts repeat near-identical text from another account.
- 50% of the activity happened within a single minute.
- 100% of the accounts were created in the last 30 days.
The whole case →
Suspicious · 5 accounts
the same hashtags · last seen Sat 15:31 UTC
- All accounts used the same combination of uncommon hashtags within one hour.
- 100% of the accounts were created in the last 30 days.
- 67% of the accounts were created within the same 72 hours.
The whole case →
Suspicious · 5 accounts
the same link · last seen Sat 16:21 UTC
- 80% of posts repeat near-identical text from another account.
- 60% of the accounts also appear in at least two other flagged clusters (24 h).
- 40% of the accounts were created within the same 72 hours.
The whole case →
Suspicious · 4 accounts
the same text · last seen Sat 16:21 UTC
- 100% of posts repeat near-identical text from another account.
- 75% of the accounts also appear in at least two other flagged clusters (24 h).
- 50% of the accounts were created within the same 72 hours.
The whole case →
Suspicious · 7 accounts
links to the same website · last seen Sat 15:28 UTC
- 100% of the accounts also appear in at least two other flagged clusters (24 h).
- 100% of the accounts were created in the last 30 days.
- 50% of the accounts were created within the same 72 hours.
Nemotron: staged, not a real crowd
The whole case →
Suspicious · 7 accounts
the same link · last seen Sat 15:28 UTC
- 91% of the accounts also appear in at least two other flagged clusters (24 h).
- 90% of the accounts were created in the last 30 days.
- 50% of the accounts were created within the same 72 hours.
Nemotron: staged, not a real crowd
The whole case →
Also active: scams, spam and bots
Suspicious · 4 accounts
the same text · last seen Sat 19:37 UTC
- 100% of posts repeat near-identical text from another account.
- 100% of the activity happened within a single minute.
- 100% of the accounts also appear in at least two other flagged clusters (24 h).
The whole case →
Suspicious · 12 accounts
the same text · last seen Sat 19:44 UTC
- 100% of posts repeat near-identical text from another account.
- Each account posted this 2.3 times on average.
- 100% of the accounts also appear in at least two other flagged clusters (24 h).
The whole case →
Suspicious · 11 accounts
the same text · last seen Sat 19:43 UTC
- 100% of posts repeat near-identical text from another account.
- Each account posted this 2.8 times on average.
- 91% of the accounts also appear in at least two other flagged clusters (24 h).
The whole case →
Where they come from
- Bluesky (native accounts)662
- Mastodon server social.roadfm.fr15
- Mastodon server social.y-gallery.net13
- Mastodon server mastodon.social, bridged to Bluesky8
- Mastodon server truthsocial.co.in8
- Telegram channel @llordofwar5
- Mastodon server m.pupu.moe4
Flagged groups per source. Mastodon servers and Telegram channels are named; individual accounts are not.
The websites they push
- rawstory.com13
- line.me11
- windowdepotmilwaukee.com11
- weact.campact.de8
- lesoleil.com7
- open.substack.com6
- lenouvelliste.ca6
Flagged groups linking to each site; lists by VIGINUM and CheckFirst.
The reviewer's desk
People check our work. 20 groups reviewed so far: 14 confirmed,
4 false alarms, 2 unsure. The honest false-positive
rate needs a random sample: 3 of 40 done.
Reviewing needs the reviewer key. The next suspicious group puts our topics first; the random sample ignores topics, so the false-positive rate stays honest.