The 15-Second Bot X-Ray: A Field Checklist for Spotting Industrial Troll Farms Across Facebook, YouTube, and Telegram

An inside view from our AI counter-disinformation pipeline after dissecting hundreds of comment threads: how the "15% arsonist rule" hijacks human psychology, why a single operator in Penza running 50 Dolphin{anty} tabs at 15 cents a paste can exhaust thousands of real readers, and how to expose synthetic personas in 15 seconds via Latin homoglyphs, CSV import headers, UID 615... series, and YouTube ru-RU locale suffixes.

1. Three Uncomfortable Truths About the Grey Zone

After parsing hundreds of suspect profiles, follower graphs, and session artifacts across Ukrainian social media threads, our AI forensic pipeline rests on one foundational axiom for 2026: comment sections on Facebook, YouTube, and Telegram are no longer sociology and no longer reflect public opinion. Treating a comment thread under a political post as a genuine cross-section of society is equivalent to walking into a carnival hall of mirrors and weeping because your reflection looks deformed.

Three structural mechanisms drive this industry:

• The "15% Arsonist" Multiplier: Russian military PSYOP units and commercial bot farms do not need to populate 100% of a thread with synthetic accounts. They only need to inject 15–20% strategically timed "arsonist" comments within the first ten minutes of publication. Biology handles the rest: an exhausted real citizen opens the post, reads the top five upvoted comments (*"everyone is betrayed / total collapse / nothing will help"*), and under acute emotional contagion becomes an unpaid volunteer amplifier of the enemy narrative.
• The Most Asymmetric Energy Exchange of the War: Evolution wired the human brain to respond to pack consensus. When fifty voices shout the same slogan simultaneously, the subconscious registers it as the voice of the street. The reader does not see that those fifty voices are a single bored operator in Penza or Saransk sitting in front of an anti-detect browser (Dolphin{anty} or AdsPower) with 50 tabs of purchased JSON-cookie sessions, hitting Ctrl+V at a piece-rate of 15 cents per comment while sipping tea. The operator forgets the paste in three seconds; the civilian reader lies awake until 02:00 AM with a spike in blood pressure.
• The Selective Moderation Litmus Test: Why do domestic "capitulation pundits" and political influencers never purge Russian botnets from their comment sections? Run a simple laboratory experiment: drop verifiable primary numbers into their threads — for instance, that Ukraine’s Pension Fund budget exceeds 1.025 trillion UAH (with 660+ billion UAH funded directly by domestic military and business payroll contributions), that 82% of Defense Procurement Agency contracts now go to Ukrainian manufacturers, and that the influencer’s own repost contains Latin homoglyph substitutions from a botnet CSV table. Within minutes, the verified facts about Ukraine’s defense industry are deleted or hidden from the main feed. Meanwhile, pinned right at the top of the thread, the host carefully preserves Russian Z-network accounts: a canned profile subscribed to Z-propagandist *Sanya in Florida*, a fake female account with a man’s forest photo deploying Kremlin war-lexicon markers, and batches of Bangladeshi auto-registered accounts subscribed to *Rossiya 1* state television. When a public figure silences verified defense data while curating Olgino trolls in their top comments, the symbiosis is deliberate: both sides are selling hopelessness.

2. FACEBOOK: Where to Look in 15 Seconds

#### Step 1. Disable the "Most Relevant" Filter Trap

By default, Meta’s ranking algorithm hides up to 60% of comments and elevates short, emotionally charged outbursts that received coordinated bot reactions in the first three minutes. Calm, detailed replies containing primary documents and registry links are automatically buried or collapsed into sub-threads. Rule number one before reading any thread: switch the dropdown from "Most Relevant" to "All Comments".

#### Step 2. Profile -> "About" -> "Following" and "Followers"

Botnet operators purchase aged, hijacked accounts (JSON-cookies + auth tokens) in bulk on darknet marketplaces (AccsMarket, DarkStore, Deer.io). They slap a Ukrainian trident or a kitten on the avatar and change the display name, but almost always forget to scrub the legacy subscription graph.

Real forensic specimens captured under prominent Ukrainian opinion leaders:

• An account preaching defeatism under the guise of a Kyiv resident — while its profile lists 1 friend and hometown Voronezh (id=100069707439257), or its Following tab displays Mordovian State University in Saransk (id=100033588340665), Russian state broadcaster *Rossiya 1*, Moscow, and Ufa.
• A profile named "Oleksandr" or "Mykola" lecturing Ukrainians on politics — while its Following tab is populated by Ramallah, Palestine (id=100043127055128), Indian construction contractors (Sumit Piling contracter), Bangladeshi profiles (Itz Rayhan, Dhaka), or French-African warmup rings (Yvonne la Choco Coiffure). These are cheap compromised Asian and Middle Eastern accounts repainted in yellow and blue.

#### Step 3. Latin Homoglyphs and Raw CSV Import Artifacts

Industrial farms provision accounts via bulk CSV spreadsheets, leaving unmistakable ingestion defects:

• CSV Column Header Leaks: In the profile of bot *Kamila Zalevska* (UID: 100011388163548), the ingestion script literally pasted the spreadsheet column header (*"Higher Education Kyiv"*) into the university field, and pasted its 15-digit Facebook system ID 100011388163548 into the Instagram handle field. In another batch (.584067), the script duplicated the first and middle name in place of a surname.
• Latin Homoglyph Substitution (i, u, o, p, c, a, e replacing Cyrillic): To blind keyword monitoring dashboards and Meta spam classifiers — and because Russian operators often lack a Ukrainian keyboard layout — bot scripts replace Ukrainian letters with visually identical Latin characters. You can test any suspicious string for mixed-script byte substitution in one second using our interactive Homoglyph & RU-Locale Forensic Detector in the site header.

#### Step 4. Friendly-Fire Safety Fuse: Never Judge by URL Digits Alone

A strict rule of engineering hygiene: never label a user a bot solely because their profile URL ends in .2025, a six-digit .XXXXXX suffix, or a numeric id=615.... Meta assigns these patterns automatically to all newly created accounts — including real Ukrainian soldiers who registered a fresh profile after losing a smartphone in combat.

Always evaluate the full forensic composite: a real human has organic life history and coherent syntax; a synthetic shell has a blank seven-year timeline, 2–24 foreign warmup friends, machine-translated American gardening posts, a fabricated 6-digit postal code (219293 from FakeAddressGenerator.com, as seen across the 6158... pseudo-page cluster), and 24/7 shift activity exclusively in political threads.

3. YOUTUBE: Russian ru-RU Locale Suffixes and the "Prophet Test"

• The Iron ru-RU Locale Fingerprint: When a bot farm bulk-registers Google/YouTube accounts using a Russian-language browser or OS interface (locale: ru-RU) without setting a custom handle, YouTube’s handle generator appends a random suffix drawn from the Russian Cyrillic alphabet. This produces handles ending in the transliterated Russian hard sign, yeru, or reversed E — characters that never appear in Ukrainian or English locale generators. Spotting a cluster of @user-... handles carrying those Russian locale suffixes in a Ukrainian thread is mathematical proof of a ru-RU registration pipeline.
• The First-10-Minutes Swarm: Immediately after a video drops, a swarm of @NameSurname-4digits accounts floods the comments with short demoralizing takes and mutually upvotes them to 150–300 likes within three minutes, locking down the top three slots on mobile screens. Click the avatar: in 90% of cases, the channel is an empty shell created purely for comment manipulation.
• The 10-Second Grifter Filter for YouTube Pundits:
• All-Caps Yellow/Red Thumbnails (*"URGENT! FRONT COLLAPSED! SECRET DEAL SIGNED!"*): Real intelligence and primary documents never scream in all-caps. Screaming is how grifters monetize your cortisol.
• The Description Box Rule: If a pundit spends 45 minutes recounting "exclusive General Staff insiders" but provides zero primary links in the description box (no Pentagon contract number, no court docket, no satellite coordinates), close the tab in 10 seconds.
• The Prophet Audit: Click the channel’s Videos tab and scroll back 3 to 6 months. Read their old headlines: 95% of the "inevitable catastrophes of next week" they screamed about half a year ago never happened.

4. TELEGRAM & TIKTOK: Fast-Cortisol Factories and Disposable Zeroes

• In Telegram: The primary indicator of an intelligence dump channel is an anonymous "insider from the Presidential Office / General Staff" or a tightly cropped screenshot of a Western article with the date, author, and URL sliced off (the signature technique of Russia’s *Portal Kombat* / *Pravda* spoof-domain network). The second indicator appears in regional municipal chats during power outages: fresh disposable "zero-accounts" in the UID 66... / 7... / 8... range with zero message history suddenly materializing to demand road blockades and arson against police vehicles.
• In TikTok: Faceless slideshow clips set to mournful music with scrolling defeatist text posted by accounts that uploaded three identical videos in 48 hours, propelled into the algorithm by a synchronized comment swarm.

5. Enabling Your Mental Firewall (ufw default deny incoming)

When we drop forensic tables and registry links into public comment threads, we are not trying to re-educate a 15-cent operator in Saransk or a professional hysteric. We post for the 90% of silent, rational readers scrolling the thread.

For your own nervous system, configure a mental firewall modeled on Linux ufw with a strict default deny incoming policy for unverified traffic: when you encounter a faceless shell with Latin homoglyphs, CSV import headers in its bio, and zero links to primary registries, drop the packet silently at the perimeter. Those are 15-cent pixels generated by a script. Never pay for them with your own health.