Run v3 · post-mortem

The coordination fingerprint

Three capture windows on the same list, five days apart, give us the first defensible answer to v1's unanswered question: does the pattern persist?

capture window ·

2024-10-26 → 2026-04-22

batch ·

batch_exporter-1776856502784__members-1776856522346

by ·

Analysis Team

When v1 went out in April, it described a dense overlap graph, a handful of central handles, and a nagging feeling that one account — @Briassulistop amplified — was receiving a suspicious amount of attention from the same small crew. Two more captures later we can say three things with numbers, not intuition.

From one snapshot to a time series

v1 was a single 13-hour window. v2 widened the capture to a rolling timeline, and v3 added another five days on top. Critically, v2 was the run where the intelligence layer first shipped — role typology, cohort detection, amplified-target ranking, cascade propagation, recurrent first-retweeter profiles. That means v3 is the first revision we can write where cross-window persistence is a question the pipeline can answer for itself.

1. 1

   v1

   2026-04-15

   Single 13-hour window. Overlap graph + ML baseline only. Identified a dense core around six handles; flagged five analytic gaps.

   197 active accounts

2. 2

   v2

   2026-04-17

   Intelligence layer lands: roles, cohorts, amplified-target ranking, cascade propagation, first-retweeter profiles. First cohort detected (54 members).

   307 active accounts

3. 3

   v3

   2026-04-22

   Fresh batch on the same list. Every signal recomputed from scratch. Cohort persistence and amplification fingerprint both testable for the first time.

   367 active accounts

The rest of the sample is a handful of stray pairs. One dominant component, same shape as v1, now nearly double the size because the window is longer.

The crew v1 pointed at is still the crew

v1 described the core as 6 handlescore spine: nickthegreek5, Track11John, giannMak, 46spiros, AgelisDimitris, angelikitsakani. v3's weighted-degree ranking reproduces that list and adds chrysib11 and Briassulis at the top. The unsupervised ML anomaly ranker, which re-runs from the raw feature matrix each time, independently places nickthegreek5#1, 46spiros#2, Track11John#3 as the top three most unusual behavioural profiles. Two different lenses, same answer.

The cohort detector is the sharper tool. It runs label-propagation on a time-tight co-retweet subgraph — accounts only connect if they co-retweeted the same originals with at least two of those within 60 minutes of each other — and then recursively splits anything oversized. Between v2 and v3, that detector's first cohort evolved like this:

v2 · 2026-04-17

54 members

target · @Technomagos

✓ 54 kept

+ 10 added

– 0 dropped

v3 · 2026-04-22

64 members

target · @ellada24

Newly surfaced

@Agie2a@FrankiKostas@Mirsini1946041@VforVolemenos@communakios@doubamari@evangelia_re@fanis_rc@fifi_apostolou@jparthen

“

54 out of 54 kept. Zero dropped. Ten added. That is not a shape that rearranges run-to-run — it is a recurrent crew.

”

The top target of the cohort shifted from @Technomagos in v2 to @ellada24 in v3, which tracks the wider window pulling in more ellada24-sourced cascades; @Technomagos is still among the top targets the cohort co-amplifies, just no longer the most frequent. The mix of who the crew boosts changes week to week; the crew itself doesn't.

One target, one crew, one speed

The hardest signal in the entire run is inbound pressure on @Briassulis. Not because of the volume — 84 retweets is not large on its own — but because of the shape.

Amplification fingerprint

@Briassulis

inbound84amplifiers8HHI0.636repeat-crew70%≤15m80

@Track11John66 · 78.6%mixed_behavior

@nickthegreek55 · 6.0%

@46spiros3 · 3.6%

@AgelisDimitris3 · 3.6%

@hatz_patty3 · 3.6%

@ArisBJJ2 · 2.4%

@Rena_Rethymno1 · 1.2%

@giannMak1 · 1.2%

Track11John alone carries 66 of 84 inbound retweets — 78.6 percent. The remaining seven amplifiers share the other 18. Eight people account for all of it, and the same eight show up across this target's top cascades (repeat-crew overlap 0.70). Eighty of the 84 inbound retweets arrive within fifteen minutes of the original.

It's mostly not a burst

v1 carried an implicit assumption: coordinated activity should look like a synchronised burst. The v3 cascade propagation data refutes that for most of this run. The same cohort touches three very different cascade shapes:

Two of the three are slow. @ellada24 takes 2.3 hours to reach ten retweets, and 75% of those retweets come from the same client build — a homogeneous device fingerprint on a sustained re-retweet. Only the @Technomagos cascade fits the stereotype of a sharp synchronised spike (kurtosis 4.7), and that one has a mixed client stack. The takeaway for analysts is a correction of reflex: "coordinated" in this data more often looks like a small crew re-retweeting the same targets over hours from a narrow device stack, not twenty identical bot accounts firing in sixty seconds.

The shape of the 367 active accounts

The deterministic role classifier ran once per capture. In v3 it labelled every active account as one of seven roles. The distribution:

• Unclassified87 · 23.7%
• Mixed behaviour83 · 22.6%
• Amplifier suspects72 · 19.6%
• Retail users56 · 15.3%
• Media / business35 · 9.5%
• Source hubs33 · 9.0%
• Journalist / public figure1 · 0.3%

Two numbers matter here. 72 amplifier_suspect is the run's primary review bucket — accounts with retweet-ratio ≥ 0.85, near-zero originals, and typically elevated first-mover counts. 87 unknown is a coverage gap, not a finding; it's mostly accounts with empty descriptions that the regex classifier can't place. The single journalist_public_figure label means the patterns are strict; if that bucket should include Greek opinion-columnists, the classifier's vocabulary needs another pass.

The recurrent first-retweeter profile — which of these accounts is first on captured cascades most often — produces its own leaderboard:

Compare @Track11John, who appears first on only slightly fewer cascades (143) but with target-HHI ten times higher — 0.20. They lead specifically on @Briassulis. Two very different lead-lag fingerprints from two accounts sitting in the same cohort.

Scoring v1's gap list, honestly

v1 enumerated five missing layers. v3 has closed some and not others. Calling it:

The new layer surfaces gaps v1 couldn't even name: quote-retweet framing (currently dropped), a burst-vs-sustained threshold rule for tagging cascades, a cohort-to-cohort coupling score, and the role classifier's coverage of Greek opinion/commentator vocabulary (23.7% "unknown" is high).

The views that back this article

Every number here is joinable back to a view in the visualizer. If you want to check a claim rather than trust the prose:

Direct links:

• Top amplified target — @Briassulis
• Cohort #1 detail
• Network graph lab
• Account browser · filter role=amplifier_suspect
• @GiotaPapapetrou profile — the classifier/network mismatch

Analyst reading

“

The coordination field v1 described structurally is the same field v3 describes structurally — and it now carries a small, stable fingerprint. An eight-person crew concentrating almost eighty percent of inbound retweet pressure on @Briassulis, with seventy-percent repeat-crew overlap across captures five days apart.

”

More carefully: the spine of v1 is the spine of v3; the cohort detector recovers it as its first cohort; the ML anomaly ranker puts three of its members in positions #1–#3; the Briassulis amplification pattern is stable across both captures that could measure it; the shape of that amplification is slow and device-homogeneous, not bursty; and the single most productive disagreement inside the system — @GiotaPapapetrou's profile/network mismatch — is worth a manual review before anything else.