This is part of a series of investigative reports published in collaboration with Daraj media

Arabi Facts Hub 12.12.2022

The digital space is no longer immune to traditional political conflicts, where geopolitical factors intersect with conflicts of foreign influence, reflecting more prominently on the pages of social media platforms. These platforms now possess conflict and influence maps that are no less intricate and complex than their counterparts on the ground.

__________________________________________________________________________________

Arabi Facts Hub (AFH) is a specialized research project that utilizes software to support Arab fact-checking platforms. This includes establishing a unified technical standard database that aggregates content from fact-checking platforms electronically. This enables wide-ranging search and analysis tools. The project aims to integrate artificial intelligence and machine learning techniques into its framework. Additionally, the project provides services, such as the "Eye on Twitter" reports, utilizing technological tools to track and identify sources of misinformation campaigns and hashtags associated with misleading news on social media. "Daraj" publishes this report in partnership with AFH.

__________________________________________________________________________________
The digital space is no longer immune to traditional political conflicts, where geostrategic factors intersect with conflicts of foreign influence. This is now more visibly reflected on social media platforms, which are now marked by conflict and influence maps that are no less intricate and complex than their counterparts on the ground.

Through analyzing virtual disputes related to political or social issues, we can now paint a more accurate picture of the intertwined virtual foreign influence in these matters. The fuel crisis in Lebanon, for example, is one of the background arenas for the power struggles between Iran and Saudi Arabia on Lebanese soil. These struggles go beyond official statements or the positions of local blocs affiliated with both countries, which have enjoyed influence in the country for decades. Naturally, this has extended to the virtual space.

With the escalating fuel crisis directly impacting Lebanon's capacity to generate electricity, Hezbollah’s Secretary General Hassan Nasrallah, supported by Iran, reiterated his earlier announcement this year of his readiness to bring Iranian fuel to the country for free. The fuel crisis is one manifestation of the economic crisis that has been ongoing for years. Lebanese citizens rely on generators to compensate for the daily long power outages. In October of last year, Prime Minister Najib Mikati’s government refrained from making positive comments when Iranian oil tankers entered through the Syrian border to avoid potential sanctions amid U.S. sanctions on the Iranian oil sector. In the summer of 2021, the United States announced its support for sending Egyptian gas through Jordan and Syria to Lebanon, however delays led to the Lebanese government expressing, via Energy Minister Walid Fayyad, its appreciation for "any assistance from a friendly state."

Concurrently with the Iranian announcement, a well-coordinated campaign surfaced to express gratitude towards Iran and laud Hassan Nasrallah as the "Master of Victories." Conversely, criticisms were directed at "The Master of Lies," reigniting virtual debates about the so-called "Iranian occupation." At Arabi Facts Hub, we traced the genesis of these interactions in order to identify key influencers, and assess the breadth of their impact.

In this context, we offer a technical analysis of endeavors aimed at amplifying the reach and impact of hashtags by the participants in these campaigns. We also examine efforts to magnify pro-Hezbollah hashtags through seemingly authentic accounts belonging to real individuals. Additionally, we shed light on endeavors to boost other anti-Hezbollah hashtags by utilizing hundreds of automated fake accounts.

Now, by virtually analyzing a political or social issue, it has become possible to paint a more accurate picture of the foreign influence that is intertwined with these issues. 

What happened?

On September 19, 2022, the Iranian Embassy informed Al-Manar, the news channel affiliated with Hezbollah, that the ships loaded with Iranian fuel would be ready to sail towards Lebanon and dock at the port designated by the Lebanese side within a week or two.

Shortly after this announcement, hashtags surfaced on Twitter in support of the move, expressing gratitude towards Iran and praising Hassan Nasrallah. Simultaneously, there were opposing hashtags related to the "Iranian occupation." One of these hashtags was #Thank_You_Iran, which gained traction with 1841 tweets, 8581 retweets, and 48044 likes at that time. It reached its peak on September 19, amassing 1627 tweets and 7368 retweets, as analyzed by the Twitter SNA feature of the InVID tool.

While the Gephi tool revealed that 839 accounts participated in the tweeting campaign using the hashtag #Thank_You_Iran. According to data from Gephi and InVID, the most active accounts on the hashtag were @AHMAD with 94 tweets, @Batoul_berjawii with 61 tweets, @mortada_rosa with 60 tweets, @fatimaZfakih with 52 tweets, @abozainab40104 with 47 tweets, and @ShahedHijazi10 with 37 tweets.

Several highly active accounts have interconnected virtual friendships through shared links on Twitter. For instance, we observed this in the account of Batoul Berjawi (@Batoul_berjawii), who is virtual friends with @xMiEdiMnD84Jx1L, @fatimaZfakih, and @mortada_rosa.

Batoul resides in the city of Zahle in the northern Beqaa region, east of the capital Beirut, and she graduated from the Faculty of Law at the Lebanese University, according to her Facebook account. One of the published photos on her account was of Hassan Nasrallah.

Batoul does not use her Instagram account to discuss political matters, only sharing personal photos, while she is actively engaged on Twitter and notably participates in other organized online campaigns beyond Lebanon.

The latest of these campaigns was in September 2022, using the hashtag #Dear_Yemen to rally support for the Houthi group in Yemen, supported by Iran, coinciding with a military parade of Houthi forces showcasing Iranian weapons.

Our analysis indicates that the same prominent accounts were actively tweeting using another hashtag (#Nasrallah_Promised_Iran_Fulfilled), which saw a sudden surge on September 20th, initially generating 1,920 tweets and over 9,000 retweets. Overall interaction with the hashtag reached 2,110 tweets, 10,114 retweets, and 54,720 likes, involving 843 accounts forming the central network of tweets.

A similar trend was observed with the hashtag #Nasrallah_Master_of_Victories, which peaked on September 18th, amassing 2,069 tweets, 10,543 retweets, and 58,983 likes. The peak moments for these three hashtags occurred predominantly between 12:00 PM and 7:00 PM Beirut time.

These accounts share similarities as they post pictures of Hassan Nasrallah, the flags of Lebanon and Iran, and a yellow heart, seemingly indicating the yellow flag of Hezbollah. Interestingly, the majority of tweets from these prominent accounts were comments on other accounts that support Hezbollah, often using the campaign hashtags. This is confirmed for the account @abozainab40104 using the Social Bearing tool. The account has over 9,600 followers and has posted 10,000 tweets since its launch in April 2022. Between 19 to 25 September, 96.7% of Abu Zainab's interactions were responses and comments on the "Party's audience," reaching over 10,000 people and being viewed nearly 200,000 times. Abu Zainab is known for rallying support for campaigns targeting the "Party's audience." In the latest campaign, he urged "every honorable individual who appreciates the Islamic Republic of Iran and His Eminence Sayyed Hassan Nasrallah to join us in using this hashtag."

What brings these together?

@farhat1_maysaa is among the most prominent accounts actively participating in the campaign hashtags. Upon reviewing her contributions under the hashtag #Nasrallah_Master_of_Victories, we noticed a tweet in which she expressed gratitude to a group called "Awfiyaa" (loyalists) for their role in mobilizing support for tweeting on the hashtag.

Maysaa responded to a twhttps://twitter.com/farhat1_maysaa/status/1571788376944017410eet by Ali Hassan Jaafar, who shared a video explaining how to elevate the hashtag to Twitter's trending topics list. Jaafar called on Hezbollah supporters to tweet until the hashtag reaches 100,000 tweets.

But who are Awfiyaa?

During our investigation, we discovered an account sharing the same name, frequently mentioned by numerous participants in the campaign. This account, identified as @awfeya1_3 and self-styled as the "Awfiyaa Group," employs the yellow heart emoji, a symbol commonly associated with Hezbollah.

Remarkably, the account has restricted access to its tweets, totaling around 50,000, making them private and visible only to individuals within its closed network.

This led us to a closed Facebook group with the same name, encompassing 3,500 members. This group was founded by an account on Facebook named "Fatimaa TB."

Among the photos posted on Fatima's account, there are repeated images of Jihad Imad Mughniyeh, the Hezbollah leader who was assassinated in an Israeli airstrike on a convoy of the party's forces in the Quneitra region in January 2015. He is the son of Hezbollah's military commander Imad Mughniyeh, who was killed in a car explosion in Damascus in 2008.

Not much information is available about Fatima, except that she identifies herself as a mathematics teacher since 2019 after graduating from the Lebanese University. She has around 3,000 followers.

However, when we examined her list of friends, we noticed that she has a friend named "Em Zahra", who claims to live in the Lebanese city of Tyre and is a member of the Imam Mahdi Scouts, an association affiliated with Hezbollah. This group comprises at least 42,000 members and has previously shared a photo featuring Iranian Supreme Leader Ali Khamenei and former Quds Force Commander Qasem Soleimani.

What grabbed our attention is that there was an account on Twitter with the same name, identified by the handle @Evakanso75, which was notably active in tweeting using the campaign hashtags. This account also expressed appreciation for the role of the Awfiya Group.

We found another Twitter account with the same name retaining the "Em Zahra" logo and mutually following each other, with slight differences (EvaRkeinKanso75). When we decoded the account's handle into a logical form of a name, we searched for it and found another account on Facebook named "Eva Rkein Kanso," displaying an image of Hassan Nasrallah without providing additional information such as location.

On March 27th, the last image posted on the account announced its closure. In the comments, a woman with the same family name asked, "Where are you hiding, my cousin?." We also examined that lady’s account, where the woman indicated that her roots are from Sour, the same city mentioned by the "Em Zahra" account. It appears that this account was created in July of the previous year, according to our examination of the Facebook posts archive. This suggests that this was the old "Em Zahra" account, although she continues to use the same name for her accounts on Twitter.

"Master of Lies"... A Swarm of Fake Accounts

The emergence of the hashtag #Nasrallah_Master_of_Victories was a response to the appearance of a counter-hashtag titled #Nasrallah_Master_of_Lies, which amassed 568 tweets, 3091 retweets, and 2172 likes until November of last year. Its peak activity occurred notably in the evening of September 17th, garnering 475 tweets and over 2954 retweets on that day alone.

Duplicated content became a distinct feature of this hashtag. The initiators of the hashtag resorted to a copy-paste method for tweet content, especially in replies, comments, or retweets involving other accounts within the campaign.

This is the same tactic used by Hezbollah supporters , as one party liner, Ali Jaffar, encouraged supporters to partake in hashtags like #Thanks_Iran and #Nasrallah_Promised_Iran_Fulfilled. As for the counter-hashtag, there were at least 50 tweets echoing the same sentiment "Nasrallah is not Lebanese" in response to a tweet from the account Pavel57464339 or Saud Ali Al Maymouni in Arabic, which was created in July 2022. 

In light of that observation, we conducted a thorough examination of 508 accounts, representing the total number of participants in the campaign. Upon closer inspection of their performance, behavior, and content, it is evident that the majority, if not all, of these accounts are fake.

Many of these accounts were created recently, particularly emerging in the current year, with a noticeable spike in activity during May and June. Additionally, there are accounts with creation dates spanning back to 2014, 2016, and 2018. Notably, the observation of multiple accounts being established on the same day strongly suggests a likelihood of these accounts being fabricated or automated.

A noteworthy coincidence was revealed when we identified two accounts that were created within a mere 11-second interval. Specifically, on July 3, 2022, the first account @smwalam43318593 was established precisely at 2:55:02 PM, followed by the second account @YAbwshamt at 2:55:13 PM.

Similarly, with a mere 39 seconds of time difference, on May 23, 2022, the account @KamalelmasryEl1 was established precisely at 7:42:27 AM, followed swiftly by another account @Mahmoud79605328 at 7:43:48 AM.

As the previous screenshot shows, we also observed the diverse geographical locations associated with the accounts, which indicate where the users live or travel to. The majority of city names are from Egypt and Saudi Arabia, but the specific cities vary widely. The plausible explanation for this is an attempt to deceive Twitter into thinking that accounts from different locations are participating in the hashtag. This diversity could be a strategic attempt to mislead Twitter into perceiving varied locations participating in the hashtag, possibly aiding in bypassing Twitter's detection mechanisms and seamlessly integrating the hashtag into popular trending topics.

Several accounts engaged in the re-posting of content from Saudi Arabian channels, such as "Saudi 24," which advocated for Crown Prince Mohammed Bin Salman and circulated positive sentiments about the Kingdom.

While there were other hashtags echoing an anti-Hezbollah sentiment, their proliferation was not robust. Some honed in on the "Iranian occupation," while others satirized Hezbollah, exemplified by #Shedding_Light_on_Lebanon, amassing 151 tweets and 3469 retweets.

An account bearing the name Jameel Murad emerged as one of the most impactful accounts in the #Shedding_Light_on_Lebanon hashtag. With only 88 tweets since its inception in September 2020 and a meager following of 64 individuals, this account is linked to a YouTube channel named @ola2721 with over 1000 subscribers, despite modest viewership. The channel features a girl conversing in the Egyptian dialect without revealing her face, predominantly promoting accessories.

The interactions of the "Jameel Murad" account with the official YouTube customer service account on Twitter became apparent. In a tweet, "Jameel" expressed frustration over the accidental deletion of his channel, later revealing that the YouTube channel had been reclassified as a business account under the name "Ola."

 Jameel Murad's Twitter interactions include official Saudi accounts and media outlets in the Kingdom. Despite the account having a limited network, interactions with its posts predominantly stem from a web of fictitious accounts sporting foreign names, primarily Turkish. Notably, one of the account’s tweets on the hashtag #Iran_Threatens_the_WorldCup garnered 375 retweets from Turkish-named accounts, many with a minimal follower count. These accounts are chiefly involved in reposting similar content, particularly related to Turkey and tweets endorsing the Turkish government.

Authentic tweets on the Iran and World Cup hashtag numbered only 16, yet the total retweet activity soared to 3503 retweets and 16 likes. This underscores that the hashtag is propelled by a network of artificial accounts with the intention of magnifying its impact.

In summary

• There are concerted efforts to amplify the reach and impact of hashtags by campaign participants.
• Pro-Hezbollah hashtags relied on seemingly authentic accounts of real individuals for amplification. Conversely, attempts to boost other hashtags opposing Hezbollah resorted to deploying numerous automated fake accounts.
• Both factions used a copy-paste approach for tweet content, leading to repetitive messaging. Nevertheless, a discernible theme and manipulation of arguments characterized the Hezbollah supporters' campaign, while the opposing faction sought to frame their message as an assault on Hezbollah's character and policies.
• Responses, comments, and retweets formed a significant margin, frequently surpassing the volume of original tweets.
• Pro-Hezbollah supporters primarily mobilized in gathering spaces, be it closed Facebook groups or leading electronic campaign accounts.
• Accounts from both factions were part of preceding electronic campaigns, some linked to regional competition areas, including Yemen (#Dear_Yemen), Iran (#Islamic_Republic_of_Iran), or earlier campaigns in Lebanon (#Hezbollah_BlewUp_the_Port). Additionally, #The_Cup_Ahly (Egypt) and #The_Army_Did_Not_Send_for_Medical_Inspection (Kuwait).

Tools utilized:

InVID Verification Plugin

Twitter Search

Social Searcher

Social bearing

Gephi

Mever

Twitual