In mid-April 2025, a group of accounts engaged with the hashtag "#تميم_في_خدمة_إسرائيل" (Tamim in Service of Israel) following a series of leaks dubbed "QatarGate." These leaks alleged that the Gulf state had paid lobbying groups to improve its image among Israeli public opinion. In May 2025, another campaign was launched—partly relying on the same network of accounts, which our analysis revealed to be fake or inauthentic.

Blogging activity under the hashtag "#تميم_في_خدمة_إسرائيل" (Tamim in Service of Israel) peaked on April 12 and 13, 2025, with 1,462 posts published in less than 48 hours—representing 86% of the total 2,846 posts related to the campaign. Activity then dropped sharply to nearly negligible levels within a few days.

Meanwhile, the hashtag "#اسقاط_نظام_الحمدين_مطلب" (Overthrowing the Hamad(s) Regime Is a Demand), which began gaining traction on May 1, 2025, saw 1,087 posts within just a few hours, accounting for 83% of the campaign’s total 1,539 posts.

This sudden spike followed by a rapid decline in both campaigns suggests a coordinated digital operation—commonly referred to as a "flash mob"—in which seemingly independent accounts are mobilized in a tightly timed, premeditated manner.

Each campaign appears to have been triggered by specific events: either the Israeli leaks and the UK court disclosures about inheritance disputes within the Al Thani family, or new lawsuits filed in California against members of Qatar's ruling family.

Discourse analysis on both hashtags revealed an overwhelmingly critical tone, with more than 97% of the posts expressing negative sentiment—prompting a deeper examination of the content’s spontaneity.

Manufactured Posts

The proportion of original posts under the hashtag "#تميم_في_خدمة_إسرائيل" (Tamim in Service of Israel) reached approximately 95% of the total, with 2,714 out of 2,846 posts classified as original content. Similarly, the hashtag "#اسقاط_نظام_الحمدين_مطلب" (Overthrowing the Hamad(s) Regime Is a Demand) saw 92% original posts.

However, our analysis of the content revealed a striking similarity in phrasing and messaging across these supposedly original posts—indicating a high likelihood of coordinated or scripted activity.

In the first campaign, more than 1,460 identical posts were detected, all published by the account "@QatarDoha1980".

The second campaign also relied on digital amplification through reposting from @ALMALKI12019’s account instead of creating original posts. 

What is striking is that the primary accounts in each campaign were not only responsible for initiating the first post with the hashtag, but also for generating the vast majority of retweets—numbering in the hundreds. For instance, the account @QatarDoha1980 published the first post using the hashtag #تميم_في_خدمه_اسراييل (Tamim in Service of Israel) on April 13, 2025, at 05:13 UTC, coinciding with the start of peak activity on the hashtag. Similarly, the account @ALMALKI12019 launched the first post using the hashtag #اسقاط_نظام_الحمدين_مطلب (Overthrowing the Hamad(s) Regime Is A Demand) on May 2, 2025, at 01:04 UTC, marking the beginning of peak activity for that hashtag.

In both campaigns, Qatar was the focal point, with 97 posts originating there using the hashtag "#تميم_في_خدمة_إسرائيل" (Tamim in Service of Israel) and 61 posts using the hashtag #اسقاط_نظام_الحمدين_مطلب (Overthrowing the Hamad(s) Regime Is A Demand), representing about 28% of total participation.

Notably, posts using the hashtags also originated from Brazil, the United States, Indonesia, Turkey, Nigeria, and even Zimbabwe.

The geographical spread of interaction on the hashtags raises questions about the credibility of these locations and whether the geographic data linked to the accounts may have been auto-generated or falsified using proxy networks or low-cost virtual private servers (VPNs).

Who Is Behind These Digital Storms?

When analyzing the relationships between the accounts, it becomes clear that a small cluster of nodes is active in both campaigns. For example, the account @QatarDoha1980 was the spearhead of the first campaign but later played a secondary publishing role in the second. Accounts like @qmpqatar and @pkrkostonee also appeared consistently among the most frequent re-posters in both campaigns.

These inauthentic X accounts, often newly created with few followers (under 30), share sequential or similar names (e.g., Qatar02023, Qatar0202). They are also characterized by high posting rates with little to no organic engagement, often publishing hundreds of duplicate posts within a few hours before disappearing entirely.

In addition, attempts were made to conceal the true geographic identity of these accounts. The methods employed by the accounts involved in both campaigns made them appear as if they were active from outside the region. In the first campaign, most of the accounts with the highest reach appeared to be based in the UK, raising suspicions about the use of VPNs or proxy servers. Suspicions are reinforced by the fact that most of these accounts tweet exclusively in Arabic about Gulf issues, without any interaction regarding events in the UK.

In the second campaign launched under the hashtag "#اسقاط_نظام_الحمدين_مطلب" (Overthrowing the Hamad(s) Regime Is A Demand), the geographic location field repeatedly displayed the suffix "zz," a marker automatically assigned by X. This suffix appears in scheduled databases extracted via Meltwater when a user's geographic information is either unknown or intentionally concealed.The widespread presence of this marker among participating accounts may indicate an effort to hide their actual geographic locations.

At the hashtag level, there was also intensive use of ready-made templates ranging from seven to nine hashtags repeated in the exact same order each time, reflecting the use of automated posting software based on pre-prepared uniform content, aimed at amplifying the campaign.

What is even more striking is the number of accounts that participated in both campaigns. 1,038 accounts out of a total of 1,573 took part in both campaigns, representing up to 66% of all active accounts involved in this operation. Among the most prominent accounts that formed the digital bridge between the two campaigns were @QmpQatar, @QatarDoha1980, and @pkrkostonee; these accounts reposted the same content with only minor changes to the hashtags or the use of different emojis.

Two Networks, One Pattern

When tracing the network relationships within the two campaigns, the features of a centralized, star-shaped structure emerge; this structure consists of a main account at the center of each campaign, surrounded by a circle of accounts dedicated to resharing or repeating nearly identical messages.

This is evident in the first campaign through the hashtag "#تميم_في_خدمة_إسرائيل" (Tamim in Service of Israel), where the account "@QatarDoha1980" serves as an almost sole central node, having posted more than 1,400 identical posts. Surrounding it are smaller accounts whose activity mostly consists of simply echoing those messages, without any original contribution.

In the second campaign,"#اسقاط_نظام_الحمدين_مطلب" (Overthrowing the Hamad(s) Regime Is A Demand), the same pattern repeats. The account "@almalki12019" leads the campaign by publishing the main text template, which was then recycled dozens of times by accounts with numbered names like "@Qatar02023" and "@Qatar02024"—accounts exhibiting identical behavior and content.

Additionally, centrality metrics, when applied to the network graph, distinctly showed the main accounts' dominance through their extensive connections within the network. In contrast, subordinate accounts typically registered only a single connection, which in most cases was the same. This reinforces the hypothesis that these accounts are merely digital megaphones that neither produce content nor engage interactively but serve a one-way role in distributing messages.

The network visualization strikingly reveals that each narrative cluster possesses a distinct network structure, identifiable by its unique color. This allows us to accurately link the repeated messages to their originating accounts and understand how the entire system is divided into small operational rooms working independently but under centralized supervision.

This reflects a common tactic in organized disinformation campaigns, where the operator isolates each group of accounts from one another to reduce the chances of their structural connections being detected by fake behavior detection systems on social media platforms.

Fake Network

Temporal analysis of posting frequency and repetition periods reveals mechanical characteristics. The central account in the first campaign, "@QatarDoha1980," posted more than 1,400 posts in less than 24 hours, averaging about one post every two seconds, with no dialogic interaction or natural breaks that would distinguish normal human behavior. This makes the account a textbook example of an "amplification bot" that does not produce new content but rather recycles the same narrative template automatically.

In the second campaign under the hashtag "#اسقاط_نظام_الحمدين_مطلب" (Overthrowing the Hamad(s) Regime Is A Demand), the account "@ALMALKI12019" dominated the scene, presenting itself as a front for human rights opposition. However, it released the equivalent of 600 posts daily within just a few hours, earning a high automated activity rating, strongly suggesting management via automated scheduling tools or uniform posting scripts.

Numbered accounts like "@Qatar02023" and "@Qatar02024" followed the same approach, acting in near coordination by repeatedly posting identical or nearly identical texts at synchronized times, reinforcing the hypothesis that they are automated.

Applying the "Bot Score" metric—which relies on three main criteria: daily posting rate, average interval between posts, and the regularity or variability of these intervals—showed that central accounts in both campaigns achieved the highest automation scores (3 out of 3). For example, @QatarDoha1980 posted roughly one post every two seconds during peak activity (1,462 posts in under 24 hours), while @ALMALKI12019 posted nearly 600 posts within a few hours, reflecting non-human posting patterns.

Secondary accounts, whose roles were limited to reposting or repeating posts, achieved medium automation scores (1 to 2), being less active than main accounts but still exhibiting semi-automated traits such as posting content consecutively and regularly without real engagement or natural timing variation.

In summary, the analysis shows that the accounts leading the digital activity of both campaigns were not ordinary human accounts but automated or semi-automated networks using software tools and automatic posting techniques to achieve intense spread within a narrow time window. This created large digital waves that give a misleading impression of real interaction or popular momentum, whereas in reality, these campaigns were artificially constructed and launched without any genuine popular base or real supporting discussion.