Analysis by Arabi Facts Hub reveals that accounts supportive of the Syrian regime and interim president Ahmad al-Shar’a were behind the spread of this hashtag.
The hashtag analysis shows patterns of coordination and deliberate amplification of certain narratives, indicating inauthentic activity aimed at influencing public opinion trends.
Beginning and development
The negotiations brokered by Washington through its special envoy, Tom Barrack, between the Syrian government and the SDF collapsed on July 9, 2025. The breakdown came after the new Syrian government insisted on maintaining Syria’s territorial integrity, keeping all weapons under state control, dismantling the SDF as a military force, and integrating its fighters into the “New Syrian Army.” SDF leadership rejected these terms, instead demanding political and administrative privileges in the areas under its control.
In the aftermath, activity around the hashtag #قسد_عدو_البلد (SDF Enemy of the Country) began modestly on July 9, 2025, appearing on a small number of low-follower accounts, most notably the account @hussainsyria3.
By July 10, however, the hashtag started to spread — not as a result of spontaneous interaction, but rather through a flood of repetitive posts issued by a limited number of accounts, indicating the launch of coordinated activity.
Activity peaked on July 11, when 4,368 posts were recorded in a single day, accounting for about 33.5 percent of the total engagement on the hashtags. A large number of the active accounts on that day posted the hashtag at rates exceeding 50 times per day, with some surpassing 250 posts, reflecting a pattern of automated content sharing.
An analysis of interaction patterns revealed an unusually high proportion of reposts compared to comments or original posts, with the latter accounting for no more than 11 percent of total activity. This suggests the presence of coordinated activity aimed at amplification through reposting.
According to data from Meltwater, the campaign’s estimated reach during the monitored period was approximately 21.4 million views. However, this figure appears inflated, as the platform calculates it based on the total follower count of interacting accounts, without factoring in repetition or actual engagement levels.
Hostile Campaign
An analysis of over 13,000 posts revealed that negative rhetoric comprised 84% of content under the hashtag #قسد_عدو_البلد (SDF, Enemy of the Country), with the majority of posts containing criticism or incitement against the SDF.
Words such as “betrayal,” “fragmentation,” “treason,” and “partition” were repeatedly used. The question “Where is the SDF’s loyalty to the Syrian state?” appeared across multiple posts, suggesting an orchestrated defamation campaign against the SDF.
Data extracted from the Meltwater platform showed that engagement with the hashtag #قسد_عدو_البلد (SDF, Enemy of the Country) was not confined to Syria alone but was spread across a wider regional scope.
Syria topped the list of countries in terms of the number of posts associated with the hashtag, followed by Saudi Arabia, then Iraq, Turkey, and the UAE.
The published geographic data showed that more than 48 percent of the posts were published from outside Syria, reinforcing the likelihood of the presence of organized amplification networks aimed at expanding the campaign regionally.
Posts from Saudi Arabia and the UAE took on a hostile tone toward the SDF, accusing it of attempting to “fragment Syria,” while the Autonomous Administration in northeastern Syria was described as a “Kurdish secession project.”
Similarly, posts originating from Iraq expressed opposition to Kurdish influence in northern Iraq and its extension into Syrian territory.
Some posts from accounts showing geolocations in Turkey also aligned with the circulating narratives attacking the SDF and Kurds more broadly.
Network Analysis: The Hub and Arms Game
Network analysis of the hashtag #قسد_عدو_البلد (SDF, Enemy of the Country) revealed a communication structure centered around a limited number of pivotal accounts—one of the clearest indicators of a coordinated or centrally managed campaign.
The network clearly displays a hierarchical pattern, with content flowing from three central accounts to a wide cluster of accounts that amplify engagement with the material.
A retweet network analysis revealed that the three most influential accounts were @marianarut680, @nayef_alsaleem, and @pataklismo01. These accounts serve as central hubs, pushing out content intensively and systematically.
They do not merely post but act as pumps for uniform content, which is later amplified by a network of affiliated or semi-automated accounts.
Other accounts, such as @husayenhamza and @sy3rie, functioned as ‘arms,’ repeatedly recycling and redistributing the content of the central hubs.
Posts from the two accounts peaked around the same time, with a posting frequency ranging between every 3 to 5 minutes during the period from 05:00 to 08:00 UTC on peak days. This diminishes the likelihood of natural, everyday human use and reinforces the assumption of pre-scheduled activity.
Posts from the two accounts reflect the same narrative: defending the ‘sovereignty of the Syrian state’ under the banner of the new regime, while linking the SDF to separatist schemes or to collaboration with Israel.
All these findings place the accounts @husayenhamza and @sy3rie in the category of coordinated inauthentic accounts: they repeat the same messages and operate on pre-set timing and schedules.
Digging deeper into the network analysis, the Louvain community detection algorithm revealed the formation of three main clusters, each with strong internal cohesion and weak connections with the other clusters. This pattern reflects groups of accounts collaborating within closed circles, which may indicate the presence of independent digital ‘control rooms’ managing each cluster.
By analyzing the degree of connectivity in likes and reposts, an imbalanced activity was revealed—driven by one-sided amplification rather than organic interaction among users.
Analyzing Influencing Accounts
The trio @marianarut680, @NAYEF_ALSALEEM, and @pataklismo01 form the backbone of the campaign against the SDF.
Despite apparent differences in their bios, these accounts share a common ideological background centered on promoting pro–Syrian regime rhetoric and calling for the eradication of what they describe as sectarian and separatist projects in northeastern and southern Syria.
An analysis of the account shows that Amer Al Ta’i Al Qahtani (@pataklismo01) produces almost no original content, instead recycling graphic photos and videos from the Hasakah and Sweida regions, framing them within a single narrative: “The SDF is looting the country’s resources and intensifying violations against Arabs.” In most of his posts, he links the “SDF occupation” to an “Israeli conspiracy.”
The account publishes content roughly every three minutes—a pace unsustainable for a human user without scheduling tools.
Nayef Al Saleem (@NAYEF_ALSALEEM) emerges as one of the prominent figures of the campaign, promoting Syrian army propaganda under slogans such as “Army Shield.” He consistently attacks the SDF and the Druze, describing their projects as a form of “internal Zionism.
The account @marianarut680, which was recently suspended by X, had been publishing over 500 posts per week, with a retweet rate of nearly 98 percent — a pattern of automated activity flagged and shut down by the platform. The rhetoric of these three accounts aligns closely with the political vision of the new Syrian regime and consistently promotes transitional president Ahmad Al Shara’a.
A Familiar Disinformation Tactic
Not only did Nayef Al Saleem’s account lead a coordinated campaign against the SDF, but it also relied on disinformation in its posts. On July 11, 2025, the account published four photos of foreign fighters, claiming they were currently fighting in the ranks of the SDF. However, reverse image searches revealed that the photos were from previous years, specifically between 2015 and 2018, during the war against ISIS in northern and eastern Syria. The first photo was traced to a report published on a Turkish website archived in 2019, documenting foreign volunteers joining the People’s Protection Units (YPG), the largest Kurdish force within the SDF. The other photos had circulated in old tweets by Turkish journalist Hüseyin Bozan as early as September 2017, and also appeared in a 2018 Rolling Stone investigative report on “international leftist brigades” that took part in the Raqqa battles.
How Campaign Accounts Operate
As part of measuring the degree of automation within the "SDF, Enemy of the Country" campaign, we developed an index combining three main criteria: the share of reposts, the regularity of posting times, and the volume of messages published by an account. The results showed that the five most prominent accounts relied heavily on automation, producing little original content while repeatedly disseminating pre-packaged messages at precise intervals in a near-automated manner.
The account @husayenhamza topped the list after publishing 151 posts, 104 of which were reposts. Its posting pattern was highly regular, with average intervals not exceeding 122 minutes between posts—highlighting its central role in pumping 104 messages into the network.
Accounts such as @alk22221, @al_muhammad63, @0sv_o, and @amsu0804 relied almost entirely on reposting—reaching 100% in some cases—while publishing on nearly identical schedules, with intervals ranging between 255 and 340 minutes. This pattern strongly suggests the use of scripts or pre-programmed scheduling tools to generate coordinated digital pressure.
When the scope of analysis was expanded to the full sample, out of 3,825 accounts that participated in the campaign, 214 exceeded an automation index score of 0.7, representing 5.6% of all accounts. This indicates that activity around the hashtag "#قسد_عدو_البلد" (SDF, Enemy of the Country) was driven by a limited pool of accounts, amplified through incitement, disinformation, and semi-automated posting.
