1 Million Posts, 400,000 Accounts: Key Accounts Drive Shah-Era Iranian Flag Campaign on X

Since late December, Iran has been experiencing waves of social protests and public anger amid economic pressures and sanctions. Each escalation on the streets has been mirrored online, with social media showing a mix of genuine reactions and engagement amplified by coordinated networks.

Recently, a campaign gained traction on X promoting the replacement of Iran’s internationally recognized flag with the former flag from the Shah’s era, featuring the lion and sun emblem (🇮🇷). The platform allowed the trend to circulate. The campaign is linked to the Iranian opposition abroad, led by Reza Pahlavi, the son of the late Shah Mohammad Reza Pahlavi.

Misbar’s team analyzed the campaign by mapping the network of accounts involved, raising questions about potential external amplification exploiting the ongoing domestic protests in Iran.

Shah-Era Iranian Flag Trend on X Boosted by Diaspora and Foreign Networks

The engagement around the Shah-era Iranian flag spiked noticeably starting January 9, coinciding with an update on X that modified the flag emoji, according to Nikita Pierre, head of product at the platform. Activity continued to rise over the following hours and days, suggesting a digital boost linked to the platform update itself rather than solely to the political content.

The campaign also experienced a significant expansion in participation, with over 400,000 accounts interacting and the emoji appearing in nearly one million posts. Even before considering the political context, these numbers indicate that the symbol had evolved from a simple interface detail into a rallying point—or at least a trend that multiple actors could leverage.

Analysis of associated symbols and participating accounts revealed widespread use of icons such as the Israeli and U.S. flags, MAGA slogans, and the Christian cross, alongside crowns, which are typically linked to Iranian royalist discourse. The Brazilian flag also appeared, suggesting involvement from South American networks, consistent with increased Spanish-language activity.

English dominated the discourse at 77 percent, indicating that much of the engagement was either aimed at Western audiences or generated within English-speaking networks. The rise of Spanish and Portuguese suggests significant contributions from Latin American networks. The absence of Persian among the top languages does not necessarily mean domestic Iranian users were absent, as internet disruptions may have limited participation. The focus on diaspora networks also points to involvement by Western accounts in amplifying content for audiences inside Iran.

Geographically, the United States accounted for 49 percent of activity, followed by Brazil at 11 percent and Argentina at around 2 percent, with additional participation from countries such as the United Kingdom, Canada, and France. Iran’s absence from the top ranks could reflect temporary connectivity restrictions or indicate that the campaign was primarily externally driven, particularly by diaspora networks and transnational political actors.

External Networks Push Royal-Iranian Flag and Protest Hashtags

In parallel with efforts by these coordinated networks to push the royal-era Iranian flag to prominence following the platform update, they also intensified the use of hashtags framing the protests as a “revolution” and promoting the restoration of the monarchy. Popular tags included ‎#freeiran, ‎#iranprotests, and ‎#iranrevolution2026, alongside hashtags highlighting digital blackouts and connectivity restrictions, such as ‎#digitalblackoutiran and ‎#internetshutdown.

Meanwhile, Persian-language hashtags were almost entirely absent from the most widely used tags, suggesting that the activity was concentrated outside the Persian-speaking sphere. This pattern aligns with previously noted factors, including internet restrictions in Iran and instances where domestic users tweeted in foreign languages to circumvent censorship.

Analysis: Diaspora and International Accounts Drive Shah-Era Flag Activity

The network analysis of participating accounts reveals a clear overlap between Western right-wing and Israeli accounts on one side, and Iranian opposition accounts on the other. Relatively separate linguistic clusters of Spanish, Portuguese, and Italian speakers also emerge, explaining why these groups appear as distinct subclusters within the network.

The engagement metrics indicate that much of the activity around the royal-era Iranian flag originated outside Iran. Prominent Iranian accounts, such as Reza Pahlavi’s, were absent from the network’s central nodes, as were Persian-language opposition platforms abroad, including Iran International.

Their absence, however, does not necessarily mean they were uninvolved in the broader discourse. Monitoring shows the flag frequently appeared in replies, quotes, and tweets referencing or directed at these accounts. In effect, the symbol functioned as a “shared language” for symbolic messaging, even when the targeted accounts were not actively driving the campaign.

The low presence of Persian within the network likely reflects multiple factors: domestic internet restrictions in Iran and the preference of many users—both in the diaspora and inside the country—to use Latin-script hashtags to reach international audiences and bypass censorship.

Key Accounts on X Driving Shah-Era Iranian Flag Campaign

• Mario Nawfal (@MarioNawfal)

Mario Nawfal’s account emerged as a central node in the network circulating the Shah-era Iranian flag—not because he produced original content about events inside Iran, but because his highly followed account actively promoted and reposted developments in real time. By including the royal-era Iranian flag in his posts, the symbol became associated with an English-speaking audience with a clearly mobilizing tone.

In coverage of the Gaza war, Nawfal ranked among the most influential accounts on X in spreading narratives related to the fighting, which explains his ability to rapidly expand the reach of any symbol or hashtag.

• Tommy Robinson (@TommyRobinson)

Tommy Robinson is a prominent figure within anti-Islam British right-wing circles, with a long history of activism in this sphere. His presence in the network adds an external political dimension: his use of the Shah-era Iranian flag does not merely signal solidarity with the protests, but aligns with a broader ideological framework linking Iran to debates over identity, migration, and political Islam in the West.

Media reports also document his participation in pro-Israel demonstrations in London in 2021, helping explain the overlap observed in the network between Western right-wing circles and pro-Israel supporters.

• Eli Afriat (@EliAfriatISR)

Afriat’s X account presents itself with ties to the Israeli military and a pro-Israel stance, placing it within a network of accounts that use political symbols in cross-border narrative battles. Regarding the Shah-era Iranian flag, Afriat appears to leverage the symbol in content critical of the Iranian regime to amplify reach following the platform update, rather than to neutrally document events inside Iran.

• VividProwess (@VividProwess)

This account belongs to a large pro-Israel network on the platform and frequently serves as a hub for reposting and directing hashtags, emphasizing its role in amplification rather than original content creation.

• Kooshiar Azimian (Kooshiar Azimian)

Although Azimian’s direct interaction with the Shah-era Iranian flag was limited in volume, his position in the network was significant due to high engagement with his posts—a common pattern when certain accounts act as “bridges” between technical, political, and media circles.

According to his company’s official website, Azimian is the founder and CEO of his firm and previously worked at Facebook, which may increase the likelihood that his posts are widely circulated within tech-focused and decision-making networks. His engagement with political figures, including Donald Trump, further increases the potential for his content to reach new networks.

Suspicious Accounts

After identifying the key accounts driving the Shah-era Iranian flag to prominence, attention turned to a broader set of accounts acting as amplification “fuel” for interactions.

The analysis focused on two common indicators used to track coordinated networks: follower count and account creation date. According to the data, roughly 60,000 accounts with fewer than 50 followers participated in interactions promoting the royal-era Iranian flag. This pattern suggests inauthentic behavior, particularly when paired with rapid, coordinated amplification.

The timeline of account creation shows two distinct spikes: the first coinciding with the “12-Day War,” involving at least 340 new accounts, and the second at the start of the new year, with roughly 1,800 new accounts in the sample. This timing may indicate the pre-creation of amplification networks in anticipation of potential military escalation involving Iran.

A random sample of these accounts revealed recurring characteristics pointing to their use for coordinated amplification. Most striking were their recent creation dates and close timing—sometimes differing by mere seconds—suggesting coordinated account generation. These accounts generally lack clear personal identities and follow a uniform behavior pattern, relying on retweets rather than producing original content. While their activity focused on amplifying interactions related to Iran, their geolocation data largely points to locations outside the country.

Moreover, location information further supports the likelihood of external activity, showing concentration in Western countries such as Germany, Australia, and the United States, even though the majority of their engagement targeted content associated with Iran.

By tracing the network of accounts and analyzing content promoting the Shah-era Iranian flag amid domestic protests, Misbar drew the following conclusions:

• The campaign on X escalated alongside waves of protests, with engagement accelerating sharply beginning January 9, coinciding with the platform’s update to the flag emoji.
• As a result, participation expanded rapidly, with more than 400,000 accounts engaging and the symbol appearing in nearly 1 million posts, effectively turning the flag into a mobilization tool susceptible to political exploitation.
• Notably, profile symbols associated with participating accounts point to a strong presence of Western and Israeli circles, including U.S. and Israeli flags, the MAGA slogan, Christian crosses, and the crown symbol linked to monarchist movements.
• Linguistically, English dominated interactions, accounting for 77% of activity, followed by Spanish and Portuguese. Persian, however, was notably absent from the most-used languages, suggesting momentum driven largely from outside the Persian-speaking sphere or a structural bias in global dissemination.
• Geographically, the United States accounted for 49% of activity, followed by Brazil at 11% and Argentina at 2%, alongside broader European participation. Iran did not appear among the leading locations, reinforcing the hypothesis of an externally driven campaign.
• At the narrative level, the surge in flag usage was closely tied to hashtags framing the protests as a revolution and promoting the restoration of the monarchy, alongside tags referencing digital blackouts and internet shutdowns. Persian-language hashtags were largely absent from the most widely circulated terms.
• Meanwhile, network analysis reveals overlap among Western right-wing circles, Israeli accounts, and monarchist actors, alongside relatively distinct linguistic clusters. Prominent Iranian accounts were absent from the network’s core, despite the frequent appearance of the flag in replies and posts referencing them.
• Additionally, a broad segment of accounts—around 60,000 with fewer than 50 followers—was identified, alongside two notable spikes in account creation: one during the so-called “12-day war” and another at the start of the new year. Behavioral indicators such as recent account creation, lack of identifiable profiles, and reliance on reposting rather than original content were prevalent. Moreover, location data places many of these accounts in Western countries, including Germany, Australia, and the United States.

Read More

Following Trump’s Threats Against Iran, Misbar Tracks Aerial Refueling Aircraft Routes

Altered and Misleading Footage Circulating From Iranian Protests