diff --git a/fediseer/observer.py b/fediseer/observer.py
index 24dc6af..7fb57c9 100644
--- a/fediseer/observer.py
+++ b/fediseer/observer.py
@@ -2,7 +2,7 @@ import requests
 from loguru import logger
 from fediseer.consts import FEDISEER_VERSION
 
-def retrieve_suspicious_instances(activity_suspicion = 20, active_suspicious = 500):
+def retrieve_suspicious_instances(activity_suspicion = 20, active_suspicious = 500, activity_suspicion_low = 400):
     # GraphQL query
     query = '''
     {
@@ -64,10 +64,17 @@ def retrieve_suspicious_instances(activity_suspicion = 20, active_suspicious = 5
                 continue
             if local_activity == 0:
                 local_activity= 1
+
+            # posts+comments could be much lower than total users
             if node["total_users"] / local_activity > activity_suspicion:
                 is_bad = True
                 # print(node)
 
+            # posts+comments could be much higher than total users
+            if local_activity / node["total_users"] > activity_suspicion_low:
+                is_bad = True
+                # print(node)
+
             # check active users (monthly is a lot lower than total users)
             local_active_monthly_users = node["active_users_monthly"]
             # Avoid division by 0