Campaign detection
Reconstruction of a real fake-gift campaign. Each line is one sighting; the bar is the accumulated certainty.
A scam lives a few hours. Between the moment it starts and the moment it lands on a blocklist, the median is several hours to two days. By the time the block arrives, it has been paid and moved to a new domain.
Analysing the page does not help either: the malicious site checks who is asking. If it is a data centre, it serves a clean page. The scanner sees a shop; the victim sees the theft.
No single signal reaches the threshold on its own. Acting on one signal is exactly how innocent people get blocked.
This is the question that sinks systems like this one. A legitimate link that goes viral has more accounts and more servers than a campaign, so those two signals tell you nothing and weigh little.
What a legitimate link cannot have is three-day-old accounts, a forty-minute window and the same text pasted over and over. That is where the points go.
| case | accounts | servers | certainty |
|---|---|---|---|
| Fake-gift campaign | 4 | 3 | 12 |
| Video going viral | 12 | 6 | 6 |
Measured: the example campaign scores 12 and a viral video posted by twelve people across six servers stays at 6, with three times the accounts.
- One person posting their own link across ten servers is not a campaign: several accounts are required.
- Ten people on the same server discussing one news item is not either: a campaign spreads across communities that do not know each other.
It builds no profile of anyone. A sighting is four numbers and no name: which link, which server, which account and how many days old it is. The first three travel as hashes.
It counts how many distinct accounts, not which ones. The verdict is about the link. Nobody is marked, and the data is forgotten after six hours.