Treadstone 71 and renowned analyst Dancho Danchev released a forensic audit today, shattering the illusion of Reza Pahlavi’s online popularity. The comprehensive report exposes a symbiotic deception in which Iranian state intelligence actively operates inside the very networks claiming to oppose them.
The investigation, analyzing over 70 million data points, documents a sophisticated “Trojan Horse” dynamic. Pahlavi’s network constructs a digital façade of millions of followers, while the Islamic Republic’s security apparatus infiltrates, manipulates, and ultimately steers it.
Forensic Certainty: A Manufactured Mandate
The analysis identifies irrefutable technical proof of automation. A “metronome” heartbeat governs the network: more than 356,000 accounts exhibit creation patterns hitting exact 60-second intervals — precision that defies human behavior.
The report further details “stylometric collapse,” where comment entropy drops below 0.35, demonstrating that scripts, not citizens, generate the text. Operators deploy “day‑zero swarms,” creating thousands of sleeper accounts in single-day bursts to replenish their inventory.
Regime Complicity: The “LocationGate” Exposure
Treadstone 71’s tradecraft used X’s “Country of Origin” transparency data to uncover the ultimate betrayal. Profiles posing as aggressive monarchists originated not from Western democracies but directly from Tehran.
These accounts used the “Iran Android App,” a connection method restricted to regime officials possessing “White SIMs” for unfiltered internet access. The Iranian regime injects radical slogans like #ThisIsTheFinalBattle, Pahlavi’s bot farm amplifies them, and State media then cites this synthetic activity to discredit all opposition as foreign-controlled.
Expert Insight
“This network does not merely boost visibility; it counterfeits consent,” states Dancho Danchev. “The Pahlavi network builds the wooden horse, and the regime’s operatives hide inside it. They treat Iranians not as citizens with agency, but as programmable inputs in an inherited family project. This deception misallocates international attention and suffocates genuine democratic voices.”
Key Findings
– Industrial Provisioning: 100% of intra-day creation gaps for the core cluster sit on a 60-second grid.
– Signature Fraud: The October 2025 petition displayed mechanical submission blocks, not organic signing patterns.
– Extremist Contamination: The network tolerates accounts displaying fascist imagery to inflate numbers, providing propaganda fuel for the regime.
The investigation offers a rare, data-driven look at how authoritarian regimes weaponize opposition movements from within. The report provides exclusive evidence, quotable expert analysis, and a clear narrative hook: a state-run botnet hiding inside a monarchist movement. The story intersects digital deception, Middle East politics, and democratic legitimacy — making it timely, globally relevant, and primed for high-impact coverage.
Treadstone 71 delivers cyber intelligence and counterintelligence strategies to help clients navigate the cognitive warfare landscape.
Dancho Danchev is a leading independent security consultant specializing in Threat Intelligence Analysis and Competitive Intelligence Research.
