Fake accounts promote incendiary rhetoric against NE Syria

The report highlights that after the breakdown of negotiations between the Syrian Democratic Forces (SDF) and the transitional government, the hashtag #SDF_Enemy_of_the_Nation quickly became one of the most trending topics in Syria.

The hashtag soon turned into a platform for widespread accusations against the SDF, including questioning its loyalty to Syria and labeling it as traitorous and separatist, according to the analysis.

Behind the spread of this hashtag are accounts supportive of the transitional government led by Ahmad al-Shara, with backing from his administration.

The analysis points to patterns of coordination and deliberate amplification of certain narratives, indicating inauthentic activity aimed at shaping public opinion.

Origins and Development

According to the analysis, activity around the hashtag #SDF_Enemy_of_the_Nation began modestly on July 9, 2025, with only a few low-followed accounts posting it, such as @hussainsyria3.

By July 10, the hashtag began to spread, not due to organic interaction, but through a high volume of repetitive posts from a small group of accounts—suggesting the start of a coordinated campaign.

The activity peaked on July 11, with 4,368 posts recorded on that day alone, accounting for 33.5% of total hashtag engagement. Many accounts posted the hashtag over 50 times in a single day, with some exceeding 250 posts, indicating automated posting.

Interaction patterns also showed an unusually high share of retweets compared to original posts or comments—original posts made up only 11% of total interactions—further supporting the idea of organized amplification.

Data from Meltwater estimated the campaign reached around 21.4 million views, though this number is likely inflated since the platform calculates reach based on follower counts without adjusting for duplicates or actual engagement levels.

A Negative Campaign

Analysis of more than 13,000 posts showed that 84% carried negative or inciting rhetoric toward the SDF. Commonly repeated terms included "betrayal," "fragmentation," "treason," and "division." Many posts questioned, “Where is the SDF’s loyalty to the Syrian state?”—suggesting an orchestrated campaign to discredit the group.

Meltwater data revealed that hashtag activity wasn’t limited to Syria. Posts were also traced to Saudi Arabia, Iraq, Turkey, and the UAE.

Notably, 48% of posts originated outside Syria, suggesting the involvement of regional networks working to widen the scope of the campaign.

Network Analysis: A Game of Hubs and Spokes

Digital network analysis of the #SDF_Enemy_of_the_Nation hashtag revealed a centralized structure revolving around a small number of core accounts—strong evidence of a coordinated campaign.

The dissemination pattern followed a pyramidal structure, with content being pushed from three central accounts to a broader group that helped amplify the message.

The three most influential accounts were identified as:

@marianarut680

@NAYEF_ALSALEEM

@pataklismo01

These acted as primary "hubs," posting intensively and systematically. Instead of creating original content, they functioned as repeaters of pre-crafted messages, which were then further disseminated by bot-like accounts.

Accounts like @husayenhamza and @sy3rie acted as "arms" of the campaign, repeating and redistributing content from the core accounts.

Their posting activity peaked at similar times, often publishing every 3 to 5 minutes between 05:00 and 08:00 UTC on peak days—suggesting non-human, scheduled behavior.

Both accounts exhibited patterns of message duplication and synchronized timing, placing them firmly in the category of coordinated fake accounts.

Further analysis using the Louvain community detection algorithm revealed three tightly interconnected clusters, each operating in isolation from the others—likely managed by independent digital “control rooms.”

Engagement analysis showed one-sided amplification, with high likes and retweets flowing from passive accounts rather than genuine user interaction.

Influential Accounts

The trio @marianarut680, @NAYEF_ALSALEEM, and @pataklismo01 formed the backbone of the anti-SDF campaign.

Despite different bios, they share a common ideological background, openly supporting the transitional government and calling for the eradication of what they describe as "sectarian and separatist projects" in northeastern and southern Syria.

One of them, Amer al-Taie al-Qahtani (@pataklismo01), rarely posts original content but frequently reposts graphic photos and videos from Hasakah and Suwayda, framed with messages accusing the SDF of robbing the country’s resources and abusing Arabs.

Another figure, Nayef al-Saleem (@NAYEF_ALSALEEM), is known for his consistent propaganda supporting the Syrian army, using slogans like “Army Shield” while attacking both the SDF and the Druze community.

The now-suspended account @marianarut680, taken down by platform X, used to post over 500 posts in one week, with 98% being retweets—a pattern flagged by the platform’s anti-bot system.

A familiar disinformation tactic

In addition to coordinated posting, Nayef al-Saleem spread misleading content. On July 11, 2025, he shared four images of foreign fighters, claiming they were currently fighting alongside the SDF.

However, a reverse image search revealed the photos dated back to 2015–2018, during the war against ISIS in North and East Syria.

Campaign Mechanics: Automation Indicators

To measure the campaign’s reliance on automation, the researchers developed a scoring system based on three criteria:

Retweet ratio

Posting schedule regularity

Message quantity

The findings showed that the top five accounts heavily relied on automation, publishing very little original content and pushing preset messages at exact intervals.

Leading the list was @husayenhamza, who posted 151 times, with 104 retweets, at an average interval of 122 minutes—indicating heavy involvement in content injection.

Other accounts such as @alk22221, @al_muhammad63, @0sv_o, and @amsu0804 had 100% retweet rates and posted at nearly identical intervals (between 255–340 minutes), suggesting the use of scripts or pre-planned scheduling tools to create unified digital pressure.

When the full dataset was analyzed, it was found that out of 3,825 accounts, 214 exceeded the automation threshold, making up 5.6% of all accounts involved in the campaign.

a.k

ANHA