How to Spot a Coordinated Disinformation Network: 7 Behavioral Signals

How to Spot a Coordinated Disinformation Network

A coordinated network is not a single source — it is a pattern across many accounts that share timing, language, and links. The signal is rarely one post; it is the structure of many posts. Seven behavioral signals that distinguish a network from a real conversation, with the limits of each signal.

Coordination is a signal, not a verdict

A network that is coordinated is not necessarily a disinformation network. Marketing campaigns, activist networks, labor unions, political parties, newsrooms, and any other group of people working together show the same signals. The coordination itself is what the signals detect. The intent is a separate question, usually answered by looking at who benefits.

Warning

Signal 1: Synchronized timing

A real conversation has gaps. People go to sleep, eat dinner, take weekends off. A coordinated network often does not — or only does so in the same time window, in the same time zone.

What to look for:

• A burst of posts on the same topic within a tight time window (often minutes, sometimes seconds).
• A burst that repeats at the same time of day, on the same days of the week, across many accounts.
• A burst that resumes immediately after a news event, with no organic lag.

The test: plot the timestamps of the posts. If the distribution looks like a heartbeat — long quiet, then a sudden spike — that is a network. If it looks like a normal conversation — gradual rise, gradual fall, with weekend dips — that is probably organic.

Signal 2: Shared or near-identical language

A real conversation has variation. Different people use different words, different phrasings, different metaphors for the same idea. A coordinated network often uses the same words, sometimes the same sentences, sometimes the same hashtags.

What to look for:

• A specific phrase that appears in many posts in a short window, sometimes word-for-word.
• A specific hashtag that appears in 80%+ of the posts on a topic in a window, when the same hashtag has 0% outside the window.
• A specific framing — a specific person named, a specific date highlighted, a specific narrative pushed — that recurs across many posts.

The test: cluster the posts by the words they use. If a small number of word-clusters contain most of the posts, that is a network. If the posts are spread across many different word-clusters, that is probably organic.

Signal 3: Shared links shared in a tight window

A real link gets shared by people who find it independently, over hours or days. A coordinated network often shares a link in a tight window — sometimes minutes — with the same anchor text, the same framing, sometimes the same screenshot.

What to look for:

• A specific URL that appears in 50+ posts within an hour, with no organic discovery curve.
• A specific anchor text — the words used to describe the link — that is identical across many posts.
• A specific screenshot or image that appears in many posts, with the same caption.

The test: plot the timestamps of the shares. If the curve is a sudden spike, that is a network. If it is a gradual rise, that is probably organic.

Signal 4: Account creation dates clustered

Real accounts are created over a long span of time, with a natural distribution. Coordinated networks are often created in a cluster — sometimes within days of each other, often in advance of an event the network is built to influence.

What to look for:

• Many accounts in the network created within a small time window.
• Many accounts created in advance of a known event (an election, a vote, a product launch).
• Many accounts with the same profile-photo metadata (same camera, same subject, sometimes the same stock image).

The test: plot the account creation dates. If the distribution shows a sudden cluster, that is a network. If the distribution looks organic, the creation dates are a weaker signal.

Signal 5: Profile photos that share metadata

A coordinated network that uses stock photos, or AI-generated photos, often uses the same source. The metadata of the profile photos can be a tell:

• Photos that share the same camera or model (visible in EXIF if not stripped).
• Photos that share the same subject (the same face, slightly modified, often via minor edits or AI generation).
• Photos that share the same source URL (a reverse image search returns the same source for many of the network's profile photos).

The test: run a reverse image search on a sample of the network's profile photos. If many of them return the same source, or the same model of generation, that is a network.

Signal 6: Amplification patterns

A coordinated network often amplifies a small number of accounts — the "hub" accounts that post original content, and the "amplifier" accounts that re-share and reply. The amplification pattern is a structural tell.

What to look for:

• A small number of accounts whose posts are re-shared by a much larger number of accounts in a tight window.
• A small number of accounts whose replies are clustered around their posts, often with similar language.
• A small number of accounts whose links are the source of most of the network's shared URLs.

The test: build a graph of re-shares. If the graph has a small number of hubs and a large number of amplifiers, with most of the activity going through the hubs, that is a network.

Signal 7: Lifecycle and retirement

Real accounts live for years, with a long tail of activity. Coordinated networks are often deployed in waves, with bursts of activity followed by long silences, and accounts that are quietly retired or repurposed after the event they were built for.

What to look for:

• Accounts that are silent for months, then suddenly active around a specific event, then silent again.
• Accounts that are renamed or repurposed after the event.
• Accounts that are deleted shortly after the event, often in a coordinated wave.

The test: plot the activity over time. If the curve shows a single spike with a long tail of silence, that is a network. If the curve shows a long history of mixed activity, the lifecycle is a weaker signal.

The limits of each signal

Each signal has a false-positive rate. A real activist network, a labor union, a marketing campaign, and a newsroom all show some of the same signals. The signals are most useful in combination:

• One signal. Coincidence. Note it, keep looking.
• Two signals. Suspicious. Worth a closer look.
• Three or four signals. Likely a network. The structure is real.
• Five or more signals. Almost certainly a network. The intent is the next question.

The intent question is usually answered by looking at who benefits from the network's activity. A network that pushes a specific narrative, that is timed to a specific event, and that benefits a specific actor is a network with a specific purpose. The purpose is the next finding, not the conclusion.

The brief

When you spot a network, the brief should:

• Name the signals you used. A reader who knows the signals can argue with the choice.
• Show the data. The timestamps, the language clusters, the account creation dates. The findings survive only if the data is on the page.
• Name the limits. A real conversation can show some of the same signals. A network can be coordinated without being disinformation. The intent is a separate question.
• Name the intent question. Who benefits? What is the network's purpose? The answer is the next finding, not the conclusion.

A brief on a coordinated network is a structural analysis. The structure is the finding. The intent is the next layer. Both belong on the page, and both are best when they are honest about the limits of the data.