On March 6, 2025, fighters loyal to the former Syrian president launched attacks against Syrian security forces, sparking intense clashes that prompted a military response from the Ministry of Defense and internal security forces. The confrontations resulted in hundreds of deaths, including several civilians.
Amid the chaos, Egyptian accounts became active on old pro-regime hashtags such as #المصريون_كابوس_بنوصهيون (Egyptians are the Zionists’ Nightmare), #هنعدل_الدستور_للرئيس_السيسي (We’ll Amend the Constitution for President Sisi), and #هتضربولنا_السد_هنضربلكم_النووى (You bomb our dam, we bomb you with nukes). These accounts circulated misleading content about the Syrian transitional government.
The campaign began when the account @abo_heaba300 published a post claiming that Turkish military vehicles had entered northern Syria to carry out a campaign of "extermination" against the Alawite sect, according to his description.
A reverse search of the video revealed it was an old clip dating back to 2019 and had no connection to the recent events in the Syrian coastal region. The video was in fact of a Turkish military convoy deployed to secure the Turkish-Syrian border.
On March 9, 2025, the same account, @abo_heaba300, posted a video showing a man beating a young girl. In the accompanying caption, the poster claimed that the security forces of the new Syrian government—whom he referred to as “ISIS”—had killed her entire family. The post quickly gained traction, spreading widely under the same hashtags previously used, despite those hashtags being more closely associated with Egypt than with Syria.
A reverse search of the video revealed that it was an old clip from September 2024, showing a Syrian father affiliated with Turkish-backed forces in the A’zaz region, harshly disciplining his daughter due to family disputes with his wife. The video had no connection to the events in the Syrian coastal region, and neither the child nor her family even belonged to the Alawite sect.
On March 10, 2025, the same account posted a clip from a speech by Ahmed Al Shar’a, the current president of Syria, labeling him a “spy of unknown lineage.” The post was accompanied by the same Egypt-related hashtags.
Our analysis of the account’s activity revealed that it is newly created. To investigate further, we extracted a random sample of 15,000 interactions—including posts, retweets, and comments—and conducted a software analysis. The results showed an abnormal engagement pattern, with posting intervals of less than a minute, high activity concentrated at specific times, and continuous nighttime posting at an inhuman pace. These indicators strongly suggest that the account is automated (a bot).
Digital Transformations
Our investigation into the three hashtags used by @abo_heaba300 in his posts about Syria revealed that they are related to the Egyptian context. The most prominent among them was #المصريون_كابوس_بنوصهيون (Egyptians are the Zionists’ Nightmare), which began trending on February 6, 2025. This coincided with U.S. President Donald Trump's remarks about his plan to turn Gaza into a tourist resort, his repeated statements suggesting Egypt would accept Gazans as refugees until the territory is rebuilt, and Egyptian President Abdel Fattah El Sisi’s invitation to meet Trump at the White House.
The hashtag first peaked on February 8, 2025, with interactions largely focused on supporting the Egyptian regime’s stance against the displacement of Palestinians from the Gaza Strip. Posts also called for national unity behind President El Sisi, alongside mocking and derogatory tweets targeting U.S. President Donald Trump.
The hashtag #المصريون_كابوس_بنوصهيون (Egyptians are the Zionists’ Nightmare) continued to trend throughout February, following the same pattern. Posts focused on rallying support around the Egyptian president, even going as far as defending businessman Ibrahim Al Organi, despite investigations revealing that his tourism company, Hala, was charging Palestinians exorbitant fees—up to $7,000 per visa—to cross the Rafah border.
By the end of February, accounts active under the hashtag #المصريون_كابوس_بنوصهيون (Egyptians are the Zionists’ Nightmare) began posting and resharing content targeting the transitional Syrian president, Ahmed Al Shar’a, accusing him of betrayal and being a traitor.
On February 27, 2025, the account @abo_heaba300 posted a tweet describing Ahmed Al Shar’a as a “spy of unknown identity.” The post included a document labeled “Top Secret”, which he claimed was issued by the Syrian Cabinet, instructing against any demonstrations opposing the "brotherly" state of Israel.
However, after verifying the source of the document, we found no reliable entity that had published it, nor did it appear on any of the official platforms of the new Syrian government. A reverse image search revealed that the design of the document resembled an official statement issued in mid-February 2025. Moreover, image analysis tools indicated digital modifications and manipulation of the content in the document titled "Top Secret", suggesting that it was a forged document that had been digitally altered.
Who Is Behind the Campaign?
A month after the appearance of the hashtag #المصريون_كابوس_بنوصهيون (Egyptians are the Zionists’ Nightmare), its spread increased significantly, reaching a total of nearly 46 million user impressions, with an average of approximately 500,000 impressions per day. This is a substantial figure for a local hashtag that had only been active for one month.
Most of the posts under the hashtag, as indicated by the associated keywords and related hashtags, were tied to the Egyptian context and supported the official Egyptian stance on the issue of Palestinian displacement. This explains why Egypt ranked first in the list of countries where users interacted with the hashtag.
An analysis of the overall interaction patterns and content associated with the hashtag #المصريون_كابوس_بنوصهيون (Egyptians are the Zionists’ Nightmare) suggests that it is part of a targeted digital campaign.
Of the total content posted under the hashtag #المصريون_كابوس_بنوصهيون (Egyptians are the Zionists’ Nightmare), original content accounted for no more than 3% of the overall posts, while the percentage of retweets and replies reached nearly 90%. This suggests that the content was intentionally amplified to achieve specific goals. To identify who was behind this campaign, we conducted a deeper investigation.
Initially, we extracted a random sample of about 20,000 tweets posted under the hashtag #المصريون_كابوس_بنوصهيون (Egyptians are the Zionists’ Nightmare), which included original posts, comments, and retweets, both with and without additional commentary. After analyzing the data, we identified the most interactive accounts with the hashtag, which provided a clearer view of the interaction patterns and the networks that helped amplify the content.
At the top of the list was the account Ahmed Elewa, which posted 767 tweets under the hashtag. However, all of the account’s interactions with the hashtag were through retweets and replies only.
However, we found that the account was newly created, dating back to February 2024. In addition to its tweets amplifying the hashtags, the account also retweeted posts by Egyptian TV presenter Ahmed Moussa - a staunch supporter of the Egyptian regime - regarding the new Syrian government.
The account also targeted the Egyptian opposition with intensive posting. It retweeted content that insulted the family of detained Egyptian activist Alaa Abdel Fattah, mocking the suffering of his mother and her illness.
The account's intense posting activity prompted us to analyze its posting pattern to determine whether it was operating in an automated manner. When we applied the software code to the account's posting data, it became clear that the account posts intensively at specific times, with intervals of less than one minute between posts. This indicates that the account is automated (a bot) or, at the very least, uses a scheduling tool to automatically publish its content.
The second most interactive account under the hashtag #المصريون_كابوس_بنوصهيون (Egyptians are the Zionists’ Nightmare) was @amralamry777, with 543 posts, all of which were retweets or comments. The account is relatively new, created in 2020. However, the key finding was its connection to the account @abo_headba300, which we had previously identified as sharing misleading information regarding the events in the Syrian coast.
The content and posting pattern of @amralamry777 closely resembled Ahmed Elewa’s. The account's intensive retweeting focused on political propaganda in support of the Egyptian regime, while also targeting and insulting the opposition. In addition, it frequently reshared and commented on posts from @abo_headba300, suggesting coordination between the two accounts.
To verify the posting pattern on @amralamry777's account, we applied the same software analysis used to identify posting patterns. This involved analyzing the posting times and the intervals between them.
Our analysis revealed that @amralamry777 follows the same pattern observed in the previous accounts, posting intensively at specific times with short intervals of no more than one minute between posts. It was also noted that the account continued to post content during the night hours, a behavior that is not typical of human activity. These patterns suggest that the account is automated (a bot) or, at the very least, uses a scheduling tool to publish its posts.
As for the third and fourth accounts on the list of the most interactive accounts under the hashtag #المصريون_كابوس_بنوصهيون (Egyptians are the Zionists’ Nightmare), both @the_innerSoul and @abo_heaba300 are relatively new, having been created in 2023. Their interaction patterns do not differ from the other accounts, as they also feature intensive posting and rapid engagement, which further raises suspicions about their automated nature or reliance on tools to schedule their posts.
An algorthimc analysis of the posting patterns of both accounts revealed that they are automated or, at the very least, use a scheduling tool for their posts. The intervals between their posts are less than one minute, with noticeable posting intensity at specific times, as well as continued posting during the night hours—behaviors that are not typical of human activity.
Intertwined Connections
To uncover more facts about the digital campaign linked to the hashtag #المصريون_كابوس_بنوصهيون (Egyptians are the Zionists’ Nightmare), we analyzed the relationships between the accounts within the random sample we had previously collected. This was done by tracing content sources and identifying the accounts that reshared or interacted with those through replies. By using network analysis techniques, we were able to reveal deeper connection patterns within the active accounts on the hashtag, providing a clearer understanding of the campaign's nature and the way it spread.
Using the Force Atlas algorithm in Gephi, it becomes clear that the network of accounts interacting with the hashtag #المصريون_كابوس_بنوصهيون (Egyptians are the Zionists’ Nightmare) consists of small clusters or nodes centered around a key account. This central account plays a major role in disseminating and resharing content from other sources. The network's content is amplified through intense resharing and replies by its affiliated accounts This contributes to artificially boosting the spread of the hashtag.
The accounts that most actively reshared content are represented by the dark orange circles. These accounts have the most connections to smaller networks of accounts that engage in resharing and commenting.
After checking these accounts on the network analysis map, it was confirmed that the first account, @abo_heaba300, is an automated bot. The network analysis also revealed that the account interacts frequently with @EdyCohen. While the content of the account's comments is predominantly negative towards Israel and promotes political propaganda supporting the Egyptian government, these comments receive extensive resharing from the network of connected accounts. This, in turn, unintentionally amplifies the visibility of Edy Cohen's content.
The third account that received significant amplification according to the network analysis and is linked to @abo_heaba300 is @Elwa3y_nour, which belongs to the Egyptian media figure Mohamed Nour.
Nour has a dedicated page on Facebook for posting pro-Egyptian government political content. He has also stated in several newspapers that he supports the regime and works actively in the digital space to promote it, alongside a group of media youth such as: Loay Khateeb, Seif Mahmoud, and Ahmed Mubarak.
The network analysis we conducted shows that Mohamed Nour has close ties to the hashtag campaign. He is the most closely linked to the other accounts in the active network of the campaign and is considered a key figure.
