Arabi Facts Hub is a nonprofit organization dedicated to research mis/disinformation in the Arabic content on the Internet and provide innovative solutions to detect and identify it.

A Suspicious Digital Campaign Under the Hashtag “With Iran Against Aggression”

A Suspicious Digital Campaign Under the Hashtag “With Iran Against Aggression”

 

The Musnad team, in cooperation with Arabi Facts Hub, monitored an unusual and escalating digital campaign on “X” under the hashtag #مع_إيران_ضد_العدوان “With Iran Against Aggression”, after detecting signs of abnormal posting and engagement activity.

Rather than an awareness campaign, this was a coordinated and organized propaganda effort. It was analyzed and tracked using Meltwater digital analytics tools and network analysis software.


 

From monitoring and analyzing the posts within the campaign, we concluded the following:

Mobilization/Incitement Content:
A large proportion of the posts included religious and emotional language such as “O power of God” and “God grant victory to the mujahideen”, focusing on glorifying the Iranian response or framing it as “revenge” or “divine victory”. This qualifies as mobilization rhetoric.

Hostile Speech:
Some posts contained direct descriptions against parties such as “the Zionist entity”, “traitors”, and “the coalition”, reflecting sharp and hostile language, though sometimes expressed in implicit terms.

Fearmongering Content:
There were recurring posts with videos or images claiming to document missile strikes without being accompanied by independent sources. In some cases, signs of visual disinformation or use of artificial intelligence were detected.

Out-of-context Mentions within the Campaign – Hostile Incitement:
Mentions of Saudi Arabia and Mohammed bin Salman:
Saudi Arabia and the Crown Prince were mentioned in about 58 posts, ranging from political criticism to direct accusations that Saudi Arabia is funding and fueling sectarian incitement and conflict to achieve Israeli objectives at the expense of Arabs and Muslims. However, these were not the central focus of the campaign, and most of these mentions appeared in neutral language or were not automatically classified as hostile.

Mobilization Incitement:
🔗 https://twitter.com/emadalden711/statuses/1935361611188904335
🔗 https://twitter.com/FarisMhdAli/statuses/1935358799889510819

Hostile Rhetoric:
🔗 https://twitter.com/lyly1840791/statuses/1935364852186247540
🔗 https://twitter.com/hasm1267/statuses/1935364850332446836

Accounts used terms such as “traitors” and “normalizers” in their attacks:
🔗 https://x.com/AlmhrgAl33/status/1934945725948838354
🔗 https://x.com/Ahmed61985/status/1935026130559582226

Fearmongering Content:
🔗 https://twitter.com/Sheikhofthej2/statuses/1935363290265424046
🔗 https://twitter.com/MLuhibi46401/statuses/1935363266768695636

Mention of Saudi Arabia:
🔗 https://twitter.com/mhmdals15036242/statuses/1935361950571184174
🔗 https://twitter.com/AhmdShrfal57627/statuses/1935355316071272449

Comments inciting against Saudi Arabia:
🔗 https://x.com/fk44582/status/1935071050024247548

 

As part of the ongoing monitoring of digital influence campaigns across social media platforms, a new hashtag has emerged that caught analysts’ attention due to the scale of its reach and the rapid pace of interaction with it over a relatively short period of time.
Preliminary digital indicators point to an unusual pattern in reach and posting distribution, particularly within Yemen’s digital sphere, warranting a closer look at the campaign’s details and an analysis of the dynamics behind its spread and the amplification tools used.

Below is a presentation of the quantitative data that forms the first step in understanding the nature of this wave:

  1. 📊 Activity Volume and Overall Reach 

The hashtag recorded a massive reach of 317 million between June 12 and June 18, 2025 — an exceptionally high figure for a campaign within this timeframe.

 

  • Average Daily Reach: Reached 45.3 million accounts per day, reflecting sustained escalation that reinforces suspicions about the nature of the digital activity.
  • Total Number of Tweets: Recorded 99.9 thousand tweets related to the campaign between June 12 and June 18, averaging around 14.3 thousand tweets per day — another indicator that the momentum exceeded the typical level for organically supportive campaigns.

 

  • Peak Activity: On June 13, there was a sudden spike in numbers, with reach exceeding 100 million accounts and 35 thousand tweets recorded on that single day — indicating a concentrated push to sharply escalate the campaign.
  1. 👥 Role of Active Accounts in Amplifying the Campaign

Data analysis revealed a pivotal role played by a specific group of accounts in driving and intensively amplifying the hashtag #مع_إيران_ضد_العدوان (With Iran Against the Aggression).

The participation of these accounts was neither spontaneous nor sporadic; rather, it was marked by suspicious intensity and evident repetition—strengthening the hypothesis of prior organization and coordinated activity.

 

 

 Most active accounts with the hashtag during the campaign:

  • @sel_ma88 – total of 120 tweets

  • @0__5__0 – total of 111 tweets

  • @mofaradji – total of 103 tweets

  • @almhtwry26665s – total of 99 tweets

  • @ahmdshrfal57627 – total of 95 tweets

  • @riya72083 – total of 94 tweets

  • @fareh1009 – total of 92 tweets

  • @abalmhdi2050 – total of 85 tweets

  • @alsyasiah – total of 75 tweets

  • @almostaka1 – total of 75 tweets

This pattern indicates that these accounts were used as digital amplifiers, either by posting repeatedly at a high frequency or through mutual engagement, which contributed to pushing the hashtag into trending lists and accelerating its spread.

1. @sel_ma88

 

Ideology: Active in sharing content supportive of the Houthis, often posting investigations/news related to مع_إيران_ضد_العدوان (With Iran Against the Aggression).

Automation vs. Human Activity: Posting patterns appear largely automated—repeated and at regular timing (+100 tweets within a few days), with a centralized retweet pattern from accounts such as @alsyasiah. This aligns with the behavior of social bots.

CIB (Coordinated Inauthentic Behavior) Assessment: High. Strong coordination in both timing and content of posts, clear indication of automated amplification, and activity that does not appear to be genuinely human.

 

2. @0__5__0

Ideology: Similar to the previous case, strong support for Houthi accounts, with repeated use of hashtags and inciting content.
Automation vs. Human Activity: Highly regular posting schedule, activity primarily triggered by the release of official statements, and reliance on copy-pasting new reports without any personal commentary.
CIB (Coordinated Inauthentic Behavior) Assessment: High. Strong indicators of automated posting aimed at amplification.

 

3. @mofaradji

 

Ideology: Posts official local news, often about projects and campaigns.

Automation vs. Human Activity: A balance between early official tweets and occasional manual engagement (unprogrammed replies/retweets).

CIB (Coordinated Inauthentic Behavior) Assessment: Medium to High. A mix of human and automated activity used to coordinate messaging.

 

4. @almhtwry26665s

 

Ideology: Focus on military attacks and solidarity with Iran.

Automation vs. Human Activity: Likely programmed to retweet only official texts, posting in “consecutive tweet series” without clear human time gaps.

CIB (Coordinated Inauthentic Behavior) Assessment: High. Appears to be a near-static bot dedicated to amplifying a specific campaign.

 

5. @ahmdshrfal57627

 

Ideology: Clear support for the Houthi narrative, active in sharing diplomatic images/details.

Automation vs. Human Activity: Clear mix of posting official texts and limited interaction. However, the number of tweets (95 during the campaign) and lack of diversity indicate semi-automated amplification.

CIB (Coordinated Inauthentic Behavior) Assessment: High.

 

6. @riya72083

 

Ideology: Publishes official summaries and statements.

Automation vs. Human Activity: Likely automated timing (regular posting) with minimal human interaction (direct messages/replies).

CIB (Coordinated Inauthentic Behavior) Assessment: Medium – amplification process focused on official content, with limited human role.

 

7. @fareh1009

 

Ideology: Shares visual designs and media content – propagandistic in support of the Houthis and Iran.

Automation vs. Human Activity: Appears to be programmed (tools for scheduling images and designs).

CIB (Coordinated Inauthentic Behavior) Assessment: Very high, due to consistent, pre-planned visual dissemination.

 

8. @abalmhdi2050

 

Ideology: Consistently publishes local news – combining institutional and defensive messaging.

Automation vs. Human Activity: Mixed, but the clear one-step approach in each tweet suggests partial manual posting.

CIB (Coordinated Inauthentic Behavior) Assessment: Medium – deliberate amplification, but with some human interaction.

 

9. @almostaka1

Ideology: Military support and mobilization, including posts about relief efforts and the official narrative.


Automation vs. Human Activity: Displays semi-automated activity with repetitive templates, but with less frequent manual posting.


CIB (Coordinated Inauthentic Behavior) Assessment: High – part of a linear, deliberate amplification activity.

The targeted accounts were evaluated using the Coordinated Inauthentic Behavior (CIB) network analysis methodology, by tracking posting and interaction patterns within the campaign. The findings revealed the presence of a non-organic communication network relying on automated amplification and repetitive content.

 

🔍 The classification of this network as CIB is based on four main indicators:

First, the massive number of tweets published within a short period of the campaign, and at closely spaced intervals, points to an automated scheduling pattern rather than natural interaction.

Second, the high repetition of identical texts and media confirms that the content was inherited from official sources without actual human input or rewording.

Third, the presence of clear coordination among accounts, demonstrated by identical posting times and hashtag patterns, often originating from a central account such as @alsyasiah.

Fourth, these accounts follow a behavior pattern similar to social bots — limited to retweets, absence of genuine interaction, and use of repetitive, impersonal linguistic styles.

📌 Based on these combined indicators, the group can be classified as a coordinated disinformation network, aiming to influence public opinion through a pre-programmed amplification strategy.

🔍 The concentration of activity in this manner supports the hypothesis that the campaign did not rely on organic engagement, but on a network of organized accounts boosting targeted messages — making it a clear example of digital disinformation campaigns.

🔄 Tweet Type Classification: Indicators of an Organized Campaign


An audit of the interaction type with the hashtag #مع_إيران_ضد_العدوان (With Iran Against the Aggression) revealed further evidence of the campaign’s orchestrated and directed nature. Data showed that retweets overwhelmingly dominated the engagement patterns:

 

 

 Retweets: 11,993 tweets – 72.6% of total activity
Original Tweets: 8,007 tweets – 11.4% of total activity
Replies: 13.6%
Quote Tweets: 2.3%

 

🔍 Analysis

This pattern indicates that engagement was not based on producing diverse content or fostering genuine discussion, but was instead primarily focused on re-posting uniform, repetitive material. The very high percentage of retweets points to a deliberate digital amplification mechanism aimed at boosting visibility and reach without creating new content.

🧠 Such behavior is common in coordinated digital campaigns, where a small set of core messages is released and then widely recycled through a network of fake or controlled accounts—creating a false impression of widespread public presence and support.

Most Influential Accounts: Nasr Amer at the Heart of the Digital Campaign

Within the digital influence analysis of #مع_إيران_ضد_العدوان (With Iran Against the Aggression), the account @nasr_amer1 emerged as the most prominent and influential figure, recording a reach of over 10.6 million accounts—making it a key source for content dissemination and interaction expansion.

🔍 Who is Nasr Al Din?


“Nasr Al Din” is the known name of @nasr_amer1, a prominent digital figure linked to senior leadership of the Houthi movement.
He is the Chairman of the Board of the Houthi-run Saba News Agency and Deputy Head of the group’s media authority.
He is widely believed to be a leader in the movement’s “hidden electronic army”. Posting and interaction patterns from his account show a central role in managing internal networks and coordinating message amplification—especially on political and propaganda topics, both locally and regionally.

📈 Next most impactful accounts by reach:

  • @sel_ma88 – 4.8 million

  • @drahmedalshami – 4.1 million

  • @alaaaswany – 3.1 million

  • @alsyasiah – 2.0 million

The content from @nasr_amer1 was not only the most widely spread, but also the most frequently retweeted—reinforcing indications that other high-volume posting accounts follow Nasr Al Din Amer’s lead. Additionally, the account @alsyasiah, which is run by the Saba News Agency (affiliated with the Houthis), appears to be a primary hub for the digital amplification process in this campaign.

 

 

By tracing the first account that launched the hashtag, we identified the account Balagh, which describes itself as the media outlet for Jabal Amel First Region. This account is part of media networks linked to Hezbollah in Lebanon.

Following this, the hashtag was shared by the account Jamal Cheaib.

jamal cheaib 

This account used #مع_إيران_ضد_العدوان (“With Iran Against the Aggression”) in a propagandistic, ideologically driven context, associating it with the resistance narrative and support for Iran.

https://x.com/JamalCheaib/status/1933475257102344656

 

Conclusion


The presence of a single account capable of generating this volume of interaction and reach—combined with a track record tied to coordinated political and propaganda activity—confirms that the campaign was not spontaneous, but rather part of a deliberate communication effort driven by organized entities within the digital space.

As part of the analysis of the most influential accounts in the #مع_إيران_ضد_العدوان (With Iran Against the Aggression) campaign, based on data collected from more than 20,000 tweets, we used network analysis tools (Gephi) and temporal analysis to uncover suspicious interaction patterns and measure the extent of the account’s influence.

We found the following activity and engagement related to @nasr_amer1 from the tweets:

1. Original tweets (posted directly by the account) within the hashtag:
Count: Only 28 tweets.

📣 2. Tweets from other accounts mentioning or retweeting him:
Count: 7,370 tweets — all starting with RT @nasr_amer1:, meaning they were retweets of his content by thousands of users.

Attached is the list of connected accounts and the number of times they tweeted.

 

  1. Accounts Most Frequently Retweeting @nasr_amer1
  • @@shehb123: 21 retweets

  • @@amr08060299: 20 retweets

  • @@tarq68900: 19 retweets

  • @@hosamalsolmi781: 17 retweets

  • @@sadg12345678: 17 retweets

  • @@sdam01972335: 17 retweets

  • @@abwmad23321806: 15 retweets

  • @@ltgtsxlkcwwweba: 14 retweets

  • @@nassertaisan: 14 retweets

  • @@fa42491: 14 retweets

  • @@hizam65736: 13 retweets

  • @@fahdjkjhk: 13 retweets

  • @@aboahmed735733: 13 retweets

  • @@rajihmamari: 13 retweets

  • @@mtmrd1234rsmyn: 13 retweets

  • @@hidaasm66: 12 retweets

  • @@abotalbmansam3: 12 retweets

  • @@mahdisa45418413: 12 retweets

  • @@ailreda481762: 12 retweets

  • @@magidmogeer11: 12 retweets

Initial Observation: Many of these accounts have random or numeric names, raising the possibility that they are automated or fake accounts.

Network of Accounts Linked to @nasr_amer1
The following image shows the direct relationships between accounts that retweeted @nasr_amer1 more than five times. This network displays a centralized pattern, indicating that the campaign’s activity was heavily focused on a single account.

 

🌐 Expanded Graph:

The image above represents a network of all accounts that retweeted @nasr_amer1 more than five times, and includes:

🟢 Each Node: An account that engaged in intensive retweeting.
🎯 Center: @nasr_amer1 as the focal point.
🔁 Each Edge: Indicates a retweet directed toward @nasr_amer1.

🔍 Technical Network Analysis:

  • High one-way concentration: All edges point to a single center, indicating these accounts did not interact with each other but only with one source.

  • "Directed Campaign" pattern:
    This type of network is common in information campaigns, where efforts are concentrated on amplifying the content of a specific account.

  • Indicators of coordination (or use of automated posting tools):

    • Intensive posting from multiple accounts within a short time frame.

    • Lack of mutual interaction among the accounts.

📅 Temporal Posting Pattern Analysis:

The following chart shows posting density for each account by hour of the day, which helps reveal automated or scheduled activity patterns.

 

 

Temporal Activity Analysis for Accounts Linked to @nasr_amer1
In the visualization above:

  • Each row represents one of the accounts that retweeted @nasr_amer1 more than five times.

  • Each column represents an hour of the day (0 to 23).

  • Darker color = higher activity (large number of tweets in that hour).

🧠 Key Observations:

  • Repeating patterns in specific hours:
    Some accounts show unusually high activity only at certain hours (e.g., between 2 AM and 4 AM or consistently every hour). This suggests scheduled or automated posting.

  • Intense activity in just a few hours:
    For example, @amr08060299 and @fa42491 have peaks in only one hour before going completely silent. This is atypical for organic human activity and closer to programmed posting behavior.

  • Synchronized posting times across accounts:
    Several accounts post during the exact same hours, which could indicate shared management or the use of unified scheduling tools.

  • Automation likelihood:
    These are not classic bots, but they are very likely semi-automated accounts programmed or coordinated as part of a focused posting campaign.

Geographic Analysis: Yemen as the Core of Digital Activity
Geographic mapping of tweets under the hashtag #مع_إيران_ضد_العدوان (With Iran Against the Aggression) shows a striking concentration in Yemen, which alone accounted for 3,833 tweets—far exceeding any other country.

  • Iraq followed with 410 tweets.

  • Then the United States, Saudi Arabia, Iran, and Lebanon in varying smaller numbers.

📌 Yemen & Account Activity
In recent months, Yemen has emerged as a primary launchpad for digital disinformation and hostile targeted campaigns, becoming fertile ground for the growth of fake accounts linked to political and ideological entities. This concentration has amplified the visibility of propaganda messages through a tightly organized network operating within a cross-border ideological framework.

📍 Geographic distribution of tweets & hashtag mentions: (visual map/chart reference)

 

 

Geographic Distribution of Activity

  • Yemen – 17,500 tweets

  • Iraq – 2,290 tweets

  • Lebanon – 1,460 tweets

  • United States – 935 tweets

  • Saudi Arabia – 888 tweets

  • Iran – 696 tweets

  • Egypt – 479 tweets

  • Algeria – 329 tweets

🔎 Interpretation:
This distribution reflects a cohesive geopolitical–ideological axis driving the campaign, with minimal participation from Gulf states or other Arab countries. It underscores the political alignment and propaganda coordination behind the effort.

Tone & Sentiment Analysis — Dominance of Negative Messaging
Analysis of the general tone in #مع_إيران_ضد_العدوان (With Iran Against the Aggression) content shows a clear dominance of negative and inflammatory rhetoric:

  • Negative tweets: 13,205 posts (>60% of total engagement)

  • Neutral tweets: 5,385 posts

  • Positive tweets: 1,410 posts

⚠ The prevalence of anger-charged, escalatory language points to a deliberate strategy to fuel tensions, influence public sentiment, and potentially threaten the openness and safety of the digital space.

 

📉 Coordinated, Incitement-Driven Behavior

This strong skew toward negativity does not appear spontaneous—it reflects a deliberate communication strategy that leverages angry rhetoric and provocative content to amplify tension.

Examples of inflammatory material include:

These posts contribute to polarization and fuel hostile sentiment, a known tactic in orchestrated digital campaigns that rely on fake accounts and closed network structures to escalate conflict and suppress open debate.

📢 Peak Influence — 13 June
The campaign’s impact peaked on 13 June, when posts by @nasr_amer1—a leader linked to the Houthi cyber apparatus—were the most circulated and engaged:

  • Each tweet exceeded 371K views

  • Over 200K likes per post

  • Became a central node for rapid, wide-scale dissemination within just a few hours.

 

But with the rapid surge in digital presence, a gradual decline in engagement was later observed, indicating the short-lived “viral” nature of inciting content, which fades once the triggering event subsides or the orchestrated push ends.

🧩 Impact Summary

This analysis shows how negative campaigns—when amplified through fake accounts and organized networks—can distort the open digital sphere, creating waves of hostile, fast-spreading, short-lived, but deeply impactful discourse.
Such content poses a real threat to freedom of expression based on diversity and dialogue, instead fostering digital environments driven by emotion rather than reasoning, and by shock rather than debate.

🧠 Word & Hashtag Cloud: Mobilization and Targeted Distraction

At the heart of the “With Iran Against the Aggression” campaign was a cloud of words and hashtags reflecting a coordinated propaganda style, shifting flexibly between hot topics, and used to craft mobilizing rhetoric aimed at stirring emotion and steering public opinion.
Analysis revealed a dominance of politically and ideologically charged terms, widely deployed to divert attention from the original issue.

🔴 Common Negative Terms:

  • "Zionist"

  • "Tel Aviv"

  • "Jaffa"

  • "Israel"

  • "The enemy" 

 

 

🟢 Positive Terms (Context-Dependent):

  • "The heroic mujahid"

  • "The strikes"

  • "Love for peace"

However, even these expressions were used in a dual manner—sometimes for emotional support, and other times for sarcasm or political insinuation.

 

 

📊 Repeated Hashtags and Entities:

  • Dominant hashtag: #مع_إيران_ضد_العدوان (With Iran Against the Aggression)

Prominent entities: Iran, Tehran, Israel, Yemen, Saba News Agency, Islamic Revolutionary Guard Corps (IRGC), Khamenei, Gaza

 

 

Repeated mentions of official names and specific political entities indicate that the campaign was not spontaneous, but rather bears the hallmark of a well-structured media operation. There was also frequent use of emojis such as 🔥 and 😂 to create either a mobilizing or mocking tone—supporting the fast, emotive style often used in digital campaigns.

📌 General Analysis


The intense focus on specific keywords, repeatedly recycled in different contexts, shows that the aim was not to deliver an informative message, but rather to flood the digital space with charged and misleading discourse—blurring issues and obscuring facts by exploiting political and religious sensitivities in the region.

Overall Conclusion:

It is clear that the hashtag #مع_إيران_ضد_العدوان (With Iran Against the Aggression) experienced a very active campaign on X within a single week, marked by:

  • A clear dominance of negative sentiment in overall interactions.

  • Unusually high participation from Yemen.

  • The emergence of mobilizing, organized content from influential accounts.

  • Massive daily reach and widespread reposting of content.