Around 5pm EST on September 21, I noticed some suspicious accounts that were spamming hashtags trending in Egypt using IFTTT (“If This Then That”), a web service that automates social media posting.

“If This Then That, also known as IFTTT, is a free web-based service to create chains of simple conditional statements, called applets. An applet is triggered by changes that occur within other web services such as Gmail, Facebook, Telegram, Instagram, or Pinterest.”

Screenshot: Twitter 5:00pm EST September 21, 2019

I collected a sample of 10,732 tweets for hashtag ميدان_التحرير_الان. (“Tahrir Square now”) and found that 2,139 tweets had been sent using IFTTT. An additional 69 tweets were sent by one obviously fake/spam account using Twitter Web App. In total, 37 fake accounts tweeted 2,228 tweets. 21% of my dataset originated from obviously fake accounts that bombarded protest-related hashtags with what seemed to be ISIS content.

I was surprised to see automated ISIS spam in trending hashtags because Twitter aggressively bans all ISIS content and these tweets were extremely obvious. Is ISIS really spamming Egyptian hashtags or is something else going on here?

Lobna Gouda noticed the fake accounts and denounced them earlier in the day on Saturday.

Lobna also told me that whoever is operating the fake accounts is closely monitoring the protests and changing the hashtags as trends evolve. If a word is added to a hashtag, the spam accounts adjust their tweets in order to keep the spam inserted into the trending topics.

This is a deliberate campaign targeting the protests in Egypt.