Holigov
Work sample
Brief · Case study
Public brief · signal/evidence level · no attribution
Stefan Thumann / Donaustahl and Leipzig: the same network reflex in one week
Anchor case: alleged plot against a German drone manufacturer (Die Zeit). Parallel measurement: Leipzig/Halle drone find — timing, volume, two-phase pattern in the Portal Kombat / Pravda network.
- Datum ·
- 2026-08-09
- Umfang ·
- approx. 4–5 pages (print)
- Quelle ·
- www.holigov.com
01Abstract
The anchor is Stefan Thumann / Donaustahl: on 5 August 2026 Die Zeit reports an alleged Russian plot against the CEO of a Bavarian drone manufacturer supplying Ukraine. In the same window the publicly documented Portal Kombat / Pravda network shows a two-phase reflex: factual relay first, then framing that attacks the credibility of the reporting.
Leipzig (airport drone find) supplies high-resolution telemetry of the same pattern that week: 74 items in 5 days, identical DE↔AT headlines within 66 seconds, factual flooding before framing.
Thumann explains why it matters; Leipzig makes the behaviour measurable. Classification separates relay from delegitimisation within the same source.
02Anchor case: Stefan Thumann / Donaustahl
On 5 August 2026 Die Zeit reports an alleged Russian plot against Stefan Thumann, CEO of Donaustahl GmbH (Bavarian drone maker, Ukraine supplier). That is the relevance core: person, company, security situation — and the fight over how the reporting is framed.
In the Portal Kombat / Pravda network the same window shows a compressed two-phase pattern: relay of the Zeit piece, then framing that relativises its credibility and uses the Leipzig coincidence against the reporting itself.
The item base is thinner than Leipzig — hence anchor case plus parallel measurement, not a standalone “proof”.
Table · Thumann strand
| Item / role | Channel | Time | Reading |
|---|---|---|---|
| Factual summary of the Zeit reporting | Telegram (relay, not a Portal Kombat domain) | 06.08., 12:27 | Neutral-descriptive · fact-based |
| Framing against credibility / “assassination plans” | germany.news-pravda.com | 06.08., 11:57 | Delegitimising · candidate-relevant |
| “Speculation” about plots (scare quotes) | austria.news-pravda.com | 06.08., 14:04 | Critical · polarising |
03Key observations
Thumann
Anchor: attack reporting credibility after a factual relay
74
Leipzig: network items in 5 days
66 s
Leipzig: gap between identical DE ↔ AT headlines
- Thumann: the load is on undermining Die Zeit’s reporting — not merely “covering the topic”.
- Leipzig: reactive amplification of public press; cross-domain mirroring as described by VIGINUM.
- Both: two-phase pattern; score behaviour, not the source wholesale.
04Leipzig parallel — publication volume
High-resolution comparison strand: network items related to the Leipzig incident (5–9 Aug 2026):
Table · Leipzig volume
| Domain (publicly documented) | Items | First item | Last item |
|---|---|---|---|
| germany.news-pravda.com | 63 | 05.08.2026, 10:45 | 09.08.2026, 17:51 |
| austria.news-pravda.com | 11 | 05.08.2026, 12:08 | 08.08.2026, 19:36 |
| Summe | 74 | — | — |
05Leipzig parallel — cross-domain synchrony
Identical German headlines on two country-specific domains:
Table · synchrony
| Headline (excerpt) | Domain | Time | Δt |
|---|---|---|---|
| „Am Flughafen Leipzig wurde eine Drohne mit Sprengstoff gefunden“ | germany… | 12:02:10 | — |
| dieselbe Schlagzeile | austria… | 12:08:31 | +6 min 21 s |
| „Leipzig: ‚Sprengstoffpräparierte‘ Drohne galt laut NATO-Sprecher ‚ukrainischem Flugzeug‘“ | germany… | 15:24:59 | — |
| dieselbe Schlagzeile | austria… | 15:26:05 | +66 s |
06Leipzig parallel — two-phase pattern
Phase 1 — factual flooding
First ~ten hours: mostly short factual relays, classified as neutral-descriptive / fact-based.
Phase 2 — framing
From the following day: delegitimising pieces and election linkage — structurally analogous to Thumann framing against reporting credibility.
Table · framing examples
| Title (excerpt) | Domain | Time | Reading |
|---|---|---|---|
| “Drone theatre in Leipzig … East elections …” | austria… | 06.08., 13:06 | Delegitimising · candidate |
| “Inside job in Leipzig? …” | germany… | 06.08., 16:02 | Critical · speculative |
| Telegram quote “Kanzlers Daddy” … | germany… | 07.08., 10:45 | Critical · candidate |
07Precision over blanket judgement
Especially on Thumann/Donaustahl, blanket source-bashing would be risky and wrong. In the Leipzig corpus only 2 of 74 items were flagged as candidates. On Thumann the same split applies: factual relay ≠ framing against the investigation.
Score behaviour and framing, not the source wholesale. Methodologically adjacent to Schneider, Steuber & Dreo Rodosek (2026).
08Limitations
- Thumann strand: thin item base — not a standalone statistical finding.
- n = 2 events in the window — not a validated population.
- Domain membership relies on VIGINUM/DFRLab, not our own operator analysis.
- No causal/impact measurement; no branding/attribution decision.
09Selected sources
- Zeit Online (05.08.2026). Berichterstattung zu Stefan Thumann / Donaustahl („Russland: Nächste Stufe: Mord?“).
- Kapsokoli, E. (2026). FIMI. CISS Working Paper 2026/017, UniBw München.
- VIGINUM / SGDSN (2024). Portal Kombat — Berichte 1–3.
- DFRLab / CheckFirst (2025). Russia’s so-called “Pravda” network expands worldwide.
- Schneider, S., Steuber, F., Dreo Rodosek, G. (2026). LLM-based Detection of Manipulative Political Narratives. arXiv:2605.14354.