How to Detect Coordinated Harassment Campaigns
Nicholas Van LandschootCoordinated harassment looks like organic outrage until you see the structure behind it. Learn the signals that separate a pile-on from an orchestrated campaign.
A wave of hostile posts can feel like spontaneous public anger. Often it is not. Coordinated harassment campaigns are organized, repetitive, and structured, and the difference matters enormously for how a security or brand protection team responds.
Look for Structure, Not Just Volume
Organic backlash is messy and varied. Coordinated activity tends to be uniform: similar phrasing, shared hashtags, synchronized timing, and recycled imagery. When many accounts say nearly the same thing within a tight window, you are likely looking at orchestration rather than coincidence.
Map the Accounts Behind the Noise
The clearest signal of coordination is the network. Mapping the relationships between participating accounts often reveals a small core driving a much larger ring of amplifiers. Newly created accounts, mutual follower clusters, and accounts that consistently activate together are strong indicators of a campaign.
Watch How Narratives Move
Coordinated campaigns push a narrative, not just insults. Tracking how a specific framing spreads across platforms and which accounts seed versus amplify it helps distinguish a manufactured narrative from genuine sentiment.
Assess Targeting and Escalation
Determine who the campaign is actually aimed at: an executive, an employee, a brand, or a location. Escalation toward doxxing, threats, or references to physical presence raises the priority immediately and may warrant looping in protective and legal teams.
Preserve Evidence Across the Campaign
Campaigns are often deleted once exposed. Preserve posts, accounts, timestamps, and the connections between them as you investigate, so the structure of the campaign can be demonstrated later even after participants scrub their activity.
Respond to the Pattern, Not Each Post
Reacting to individual posts is a losing game. Once the structure is mapped, teams can respond to the campaign as a whole, prioritize the accounts that matter, and brief stakeholders with evidence rather than anecdotes.