Capture the evidence first

• Do NOT like, reply, follow, or report-and-lose the item before you've preserved it.
• Note your timezone and the exact time you started (from the system clock).
• Decide your subject — the account/post whose engagement looks manufactured.

• Screenshot at full resolution with the system clock visible.
• Save the page itself (right-click → Save As → "Webpage, Complete").
• Archive the URL to the Wayback Machine ("Save Page Now") AND archive.today.
• Record the canonical URL + the account's permanent numeric ID (survives handle changes).
• Hash every saved file with SHA-256 the moment you save it (commands below).

• Originals are write-once — never edit a capture; annotate copies only.
• Log every time evidence is copied, moved, or examined (append-only).
• Keep one untouched master you never open for editing; work on copies.

macOS / Linux:   shasum -a 256 OBS-1-shot.png
Windows (PS):    Get-FileHash OBS-1-shot.png -Algorithm SHA256

# · engaging account (ID) · action · timestamp (UTC) · source URL · archive URL · file(s) · SHA-256 · captured (UTC)

Write “indicators of coordination,”never “bot,” “fraud,” or “proven.” Document over speculate. Collect from public posts only. A reporting decision rests with a human, with counsel.