Campaign report · NET-001
42 accounts, one script: a network posing as Saudi citizens
Between 15 and 19 October we documented 42 X accounts with Saudi (and some Emirati) names and photos that posted in tight bursts: the same video, reworded text and the same three unrelated trending hashtags. Their behaviour appears coordinated. We have not identified who operates them.
#synchronized posting#same media, reworded text#unrelated trending hashtags#batch-created accounts#citizen personas
1 · Synchronized posting
On 18 October, ten accounts posted the same 8.219-second video between 16:08:49 and 16:11:25 UTC. Accounts are anonymized (A01–A10).
How to read this: each dot is one post, placed by its exact posting second; ten different accounts fall inside 2 min 36 s.
2 · Posting-time heatmap
All 77 posts fell inside four one-hour sessions. Each cell is two minutes; darker means more posts.
How to read this: rows are one-hour sessions, columns are two-minute slots. Empty rows between sessions mean the accounts were silent.
3 · Content cluster
Posts grouped by identical video length. Five videos account for 55 of the 77 posts. The text was reworded each time (character overlap between 2% and 34%), but the media file was the same.
- 1890.139 s
- 108.219 s
- 990.279 s
- 918.018 s
- 9124.853 s
How to read this: each circle is one video file, sized by how many posts used it. The number is the posts; the label is the video’s exact length.
4 · Account-creation dates
Accounts were created in batches: 9 on 22 July 2026, 6 on 31 May, 5 on 4 August, 5 on 31 March. Monthly counts, 2024–2026.
- 1
- 1
- 6
- 1
- 4
- 5
- 2
- 8
- 9
- 5
How to read this: each bar is one month. Tall single bars mean many accounts were created close together.
What this does and does not show
- Shows: shared media, tight timing, batch creation, templated bios and filler posts between bursts — patterns that, together, appear coordinated and inauthentic.
- Does not show: who runs the network. We make no attribution to any state, organization or person.
- Content: the posts are written in the persona of Saudi citizens and mix political messaging with lifestyle filler. One burst pushed a rumour that a Pakistani worker had been executed, for which we found no official record. We do not reproduce the posts.
- Method: public posts only; times decoded from X identifiers; accounts anonymized. Framework: EU DisinfoLab CIB detection tree.
Data: research-mecca-executions/phase6/raw/net/network_posts.csv (77), network_accounts.csv (42); saudi-monitor/known-networks.csv NET-001 (confidence: high for coordination).