Ibrahim Hilal

This report analyzes a coordinated online campaign that both preceded and was concurrent with the Iran protests in late December 2025, revealing its operation from accounts outside Iran. This campaign was notably characterized by its intersection with pro-Israel rhetoric. It began by promoting Reza Pahlavi as a "monarchist" alternative to the Iranian regime, then evolved into calling for the "liberation of Iran" through US/Israeli military intervention.

The online spark was ignited on December 20, 2025, via the hashtag #KingRezaPahlavi on Instagram, and later spread with hashtags like #FreeIran and #IraniansStandWithIsrael.

The timeline showed a disproportionate surge in the volume of posting and reach, especially before the "Grand Tehran Bazaar" protests, despite the subsequent internet cutoff inside Iran.

Data on Brand Mentions shows that the campaign achieved a massive total reach across more than 102,000 posts, pointing to coordinated, cross-border digital amplification. The campaign's dominant platforms were Instagram and 'X' (formerly Twitter), with interaction heavily concentrated in the United States and Europe, and English being the prevalent language. Highly active accounts, many of which were new, had altered their identities, or had few followers, appeared as key promoters. This pattern suggests automated or coordinated activity. Furthermore, Israeli and pro-Israeli accounts directly amplified the protest calls. Indicators also suggest that some of these accounts were being managed from locations other than those they officially declared.

The report also documents a counter-digital campaign launched by the Iranian regime via the hashtag #تروریست‌های_موساد ("Mossad Terrorists"), to portray protesters as agents of Israeli intelligence agencies and justify violence against them. The campaign began from the account of the Tasnim News Agency, which is affiliated with the Islamic Revolutionary Guard Corps (IRGC), and then was amplified through a network of pro-regime accounts, many of which were newly created or anonymous, and some managed from outside Iran. Although the number of tweets on the hashtag did not exceed 296, the estimated reach was about 19 million, with nearly 27 thousand interactions, which is an indicator of coordinated amplification in the absence of genuine discussion or wide organic interaction.

The analysis reveals a complex picture: While genuine protests rooted in Iran's internal economic and political conditions are taking place, the digital realm is mainly characterized by two opposing, orchestrated campaigns. One is spearheaded by external opposition networks, some of which feature accounts promoting pro-Israel viewpoints. The other is run by the Iranian regime, utilizing its media and security apparatus. Both campaigns employ similar tactics, relying on non-original content and leveraging platform features to amplify their reach and influence over public opinion regionally and globally.

Before the spark of the protests ignited in the "Grand Bazaar of Tehran" on December 28, 2025, which quickly spread to a number of Iranian provinces, and coinciding with the escalating pace of the protests and their transformation into daily clashes with security forces in the streets of several cities in Iran, a coordinated digital campaign appeared on social media platforms, led by Iranian and non-Iranian accounts active from outside Iran, whose discourse intersected with pro-Israel narratives.

The protests had erupted in Iran due to the economic collapse and inflation, which reached a rate of 42-52%, along with the collapse of the Iranian Rial, rising food and energy prices, and shortages of water and electricity, pushing small businesses to the brink of bankruptcy.

The protests eventually took a distinct political direction, marked by demonstrators chanting, "No Gaza, No Lebanon, Janam (My Soul) For Iran." While the Iranian regime initially responded to this calmly, its reaction soon became violent, resulting in the direct killing of protestors. These political slogans emerged alongside a separate narrative that was being promoted on social media platforms through a coordinated digital campaign.

The campaign, in its first phase, aimed to promote the grandson of the late Shah Mohammad Reza Pahlavi as a monarchical alternative to the Islamic Republic system in Iran, before its discourse gradually evolved into calling for the "liberation of Iran" through American/Israeli military intervention.

On December 20, 2025, the hashtag #kingrezapahlavi, promoting Reza Pahlavi, the Shah's grandson, as a political alternative to the Iranian regime, appeared on social media platforms. The hashtag initially appeared on the account of an Iranian woman residing in the United States on Instagram named golbanafsheh, who is an opponent of the Islamic Republic regime and supports an American strike on Iran. She published a picture on her account of herself with Reza Pahlavi.

The account "duchess.of.erskine" on Instagram was also one of the first accounts to use the hashtag, as it published a picture of the Iranian Supreme Leader, Ali Khamenei, on December 21st, accompanied by two additional hashtags: #freeiran and #i_stand_with_israel. The account also published a picture of anti-Iranian regime protests that appear to be in the United States, showing demonstrators carrying the Israeli flag alongside the old Iranian royal flag.

On the same day, December 21, 2025, the Instagram account rezadelsim, which is dedicated to promoting Reza Pahlavi, published a statement calling on Iranians inside and outside the country to "revolt" against the Islamic Republic regime, describing it as "evil," according to the published statement.

The discourse promoting Reza Pahlavi as a political alternative to the Iranian regime, calling for the overthrow of the Islamic Republic, and using these hashtags, has been dominated by two main groups. These include Iranian accounts that support Israel and non-Iranian accounts that openly embrace Zionist narratives.

An Online Surge Preceded the Spark of Protests

On December 21, the use of hashtags promoting Reza Pahlavi and calling for "revolution" against the Islamic Republic regime in Iran increased, particularly on Instagram. On this day, an account named iranian_women_organization_ published a post including the hashtag #KingRezaPahlavi, along with video clips promoting Pahlavi as a political alternative to the Iranian regime.

Instagram's transparency feature showed that the account was created in 2018, and its location is set within the United States.

The same hashtag also appeared in another post by an Instagram account named durood_persian, which published a video clip of protests seemingly in a Western country, showing protesters holding a picture of Reza Pahlavi next to the Israeli flag. The transparency feature indicated that the account is relatively new, having been created in 2022, and its location is listed as Denmark.

On the same day, other posts appeared bearing the hashtag #iranrevolution and the hashtag #IraniansStandWithIsrael, bringing the number of posts on that day to thirty-two. This number gradually increased as calls for demonstrations continued inside Iran, reaching about 4,900 posts on January 10, 2026, achieving an estimated reach of about 1.5 million times. This reach is disproportionate to the number of posts, especially in light of the indication that Iranian authorities had cut off internet service inside the country on January 8, 2026.

Analysis using Brand Mention revealed remarkably high figures: approximately 102,000 posts were associated with these hashtags, generating an estimated total reach of about eleven billion times and nearly 167 million recorded interactions. These statistics are indicative of a pattern of coordinated posting and amplification.

Posts were distributed across various social media platforms, with Instagram accounting for the largest percentage, at about 47% of the total content, followed by X with about a quarter of the posts, and then Facebook and YouTube with smaller percentages.

Sentiment Analysis and Interaction Map

Sentiment analysis of the posts revealed a striking contradiction: the dominance of both "love" and "anger." Closer scrutiny of the posts categorized as expressing "love," however, indicated a potential manipulation of sentiment. Specifically, many of these posts included positive emojis, such as hearts, yet contained explicit calls for military intervention to "save Iran" or originated from accounts that openly expressed support for Israel.

A map of the accounts interacting with the hashtags showed that the largest proportion of interaction came from the United States, followed by Germany, and then Iran in third place, before Canada, the United Kingdom, and India. This geographical distribution intersects with the peak posting times, which ranged between 12:00 AM and 10:00 AM Cairo time, periods that largely correspond to the time zones in North America.

This was reflected in the language of the content, with English dominating more than half of the posts, at nearly 56%, followed by Persian at less than a quarter of the posts, and then German and French with lower percentages.

The campaign's indicators were similarly reflected in the word cloud and its most frequent hashtags. The hashtag #freeiran was the most used, followed by #iranmassacre. Additionally, #rezapahlavi, which promotes Pahlavi, and the word "Israel" were also prominent among the most frequently used hashtags.

The most interactive accounts with the campaign: A noticeable presence of pro-Israel accounts

By analyzing the data of the accounts participating in the campaign, it became clear that the most interactive account was a Facebook account named "کشور باستانی ایران در گذر تاریخ", which means "History of the Ancient State of Iran". The transparency feature showed that the account is active from within the United States.

The account's data reveals a transformation: it was initially created in 2014, focusing on books and art. In 2023, however, the name was changed and the account pivoted to promoting the Pahlavi monarchy in Iran. During the monitoring period, the account published 961 posts as part of the campaign calling for protests in Iran, and its post history shows content celebrating a speech delivered by Israeli Prime Minister Benjamin Netanyahu, in which he called on Iranians to "rise up" against the Iranian state.

Next was Simay Azadi TV's YouTube channel, which published 787 posts within the campaign. The channel's data indicated that it broadcasts from within the United States.

The account "خسته @SOLSSSHK" stood out on X, having posted 435 tweets within the campaign. Data showed the account is active from the United States and does not use a real profile picture. The account is relatively new, having been created in 2024. The account has published 514 tweets since its creation, with campaign-related posts constituting the vast majority, despite the account having only a single follower. The content primarily relies on the repetition of fixed sets of hashtags, which points to an automated posting pattern or digital amplification.

The account " Amin Yamousa," on Facebook, came in fourth place, publishing 332 posts as part of the campaign. An investigation into the account revealed that this individual is also a supporter of Reza Pahlavi. The last location specified by the user was near the Iranian Consulate in London, where they posted a video of demonstrators raising the old royal version of the Iranian flag alongside Israeli flags.

Israeli Accounts Participated in Calling for Protests in Iran

The accounts most engaged with the hashtags were found to be pro-Israel accounts, and the Israeli flag was clearly present in most of the protest videos they published. The campaign also saw direct involvement from Israeli accounts that explicitly called for protests inside Iran.

Among these accounts is the "israeldirectlive" account on Instagram, which posts in French. Its posts focus on attacking the Iranian regime and supporting Israel. The account is relatively new, created in 2024, and its geographical location is not specified. It published 60 posts as part of the campaign.

The "Stand with Israel" accounts also shared 40 posts as part of the campaign. According to its data, the account was created in 2023 and listed its location as Israel. The transparency feature shows that the account was previously named "Fun Dance & Trending videos" before changing its identity in 2024 to Stand with Israel, and is currently managed by two people in India, which indicates a commercial or inauthentic nature of the account.

Also among the participating accounts is the "Jewish Diaspora Podcast" account on Instagram, which was created in 2021 and contributed 23 posts to the campaign.

The account "Maison LYS Israel" on Facebook also participated. This account is dedicated to supporting Israel, according to its data. It published 20 posts as part of the campaign calling for protests in Iran. Although the account specified its location as occupied Jerusalem, the transparency feature revealed that it is managed from the Republic of Congo, reflecting a cross-border network.

In addition to these accounts, a large number of Israeli or pro-Israel accounts interacted with the campaign, explicitly calling for an uprising against the Iranian regime, and linking it to the call for the return of the monarchy in Iran as a system "reconciled with Israel."

On the other hand, the Iranian regime sponsored a coordinated counter-digital campaign. This campaign employed rhetoric that labeled all protestors as "terrorists, agents of the Mossad," thereby providing justification for the killing of demonstrators.

The campaign appeared on social media in Iran associated with the hashtag #تروریست‌های_موساد, which means "Mossad Terrorists," referring to the protestors and describing them as "agents of the Mossad."

The hashtag first emerged on January 13th. The "Tasnim News Agency," an account linked to the Iranian regime and the Iranian Revolutionary Guard, was the first to use this hashtag when referring to the protesters in Iran.

The "Tasnim Agency" account published only two tweets on January 13th, and the number increased the next day to 6 tweets. An Iranian account supporting the Islamic Republic regime reposted one of the "Tasnim Agency" tweets, endorsing its narrative about the presence of Mossad elements shooting at demonstrators in the protests.

Examination of the account showed that it does not use a real profile picture, and the account's username consists of random letters and numbers. It is a relatively new account, appearing in 2018. It described itself as a petroleum engineer from Tehran University, "waiting for a call.. I am the rest of God." However, the transparency feature on X showed that the account interacts from Turkey, and it became a verified account in May 2025, after changing its username 40 times!

On January 15th, tweeting about the hashtag reached its first peak with 18 tweets, 12 of which were posted by "Tasnim News Agency". The rest of the tweets were published by accounts that were all supportive of the Islamic Republic regime in Iran and adopted the same narrative describing the protestors as "Mossad agents."

One of these accounts that interacted with the hashtag is an Arabic account named Ali 3I3 @Mohamme6664666. Examination showed that it posts in Arabic and Persian, but Arabic prevails in its tweets, and it uses a picture referring to events on the Syrian coast, which increases the possibility that the account owner is Syrian. It is a new account created in 2025, and the transparency feature shows its location is in Germany.

Another account that interacted with the hashtag is named Amin «Live The Moment Now» @Amin1311210, which posts in Persian and supports the Iranian regime. It was created in 2020, but the transparency feature showed that its location is in Iraq.

Additionally, on the same day, an account called "Irandokht57 اکانت سوم @shidokht50" engaged with the hashtag. This account, which supports the Iranian regime and uses the flag of the Iranian Republic as its background image, is also notable for not using a personal picture. Furthermore, this is a new account, created in 2022, that has already changed its username twice and lists its location as Canada.

All accounts that initially published and interacted with the hashtag were found to support the Iranian regime. Furthermore, these were not real accounts and consistently adopted the regime's narrative, specifically by labeling the protestors as "Mossad agents."

Indicators of the Campaign

Since the start of the campaign on January 12, the number of tweets associated with the hashtag #تروریست‌های_موساد reached 296 tweets, achieving an estimated reach of about 19 million times, and an interaction of nearly 27 thousand interactions.

These numbers indicate initial signs of amplification, as analyses showed the dominance of "negative" language in most tweets, reflecting the absence of actual discussion or spontaneous interaction among participating accounts. Sentiment analysis also showed that anger was the most prevalent emotion compared to the rest of the emotions.

This was reflected in the word cloud and the most circulated hashtags, which centered around the narrative that the Iranian authorities sought to establish. Among the most prominent hashtags and words:

#Mossad_terrorists #Civil_war #Disturbances #Massacre #Stabbing_Trump #Riots #American_sedition #Mossad_terrorists #America

These are hashtags that supported a narrative portraying the protestors as Mossad agents carrying out riots, and presenting the protests as "American sedition."

Unlike the opposition campaign led by accounts outside Iran and spread across several platforms, Persian language prevailed in this campaign, which indicates a local character in the discourse, and the activity focused primarily on the "X" platform.

Who is driving the interaction on the hashtag #تروریست‌های_موساد

Analyses showed that the accounts most interacting with the hashtag were Iranian accounts supporting the regime, seeking to reinforce its narrative regarding the protests.

The list was topped by the "Tasnim News Agency" account, which was monitored as the initiator of the hashtag, and published 135 tweets, all of which included the hashtag #تروریست‌های_موساد.

In second place came the account KIAN @K1ANM3HR, which published 52 posts. It is a relatively new account and supports the Iranian regime. The transparency feature showed that its declared location is in Switzerland, while it connects to the application from China.

In third place was the account @Dr11l1ngEng, which was monitored at the beginning of the campaign, and published 13 posts, all of which included the hashtag #تروریست‌های_موساد.

In fourth place appeared an Iranian account named آسد محمد@s_m_estand, which is an account created in 2022, supports the Iranian regime, and published 7 posts within the campaign.

The account "حسين @SayyedHossein" ranked fifth, having published six posts. This account supports the Islamic Republic regime and identifies as part of the "Axis of Resistance." While its posts are in Persian, the transparency feature reveals that its declared location is Denmark.

An analysis of the online campaign surrounding the late 2025 Iran protests indicates that the conflict transcended street demonstrations, playing out significantly on social media platforms. Here, competing narratives sought to define the events: one presenting the movement as seeking foreign intervention, and the other labeling it an external conspiracy aimed at destabilizing the country. This polarization marginalized non-ideological civil and protest voices, giving precedence to a coordinated mobilization discourse frequently managed from abroad.

On one hand, multiple opposition networks used advertising targeting tools and hashtag amplification to present Reza Pahlavi as a political alternative, and to push the discussion toward legitimizing foreign military intervention. On the other hand, the Iranian regime relied on a media and security apparatus that uses semi-anonymous accounts to distort the image of the protestors and link them to the Mossad, and to transform economic and political demands into an "external conspiracy" that justifies repression. The data patterns in both cases show that a significant percentage of the interaction was characterized by unnatural features in terms of volume, timing, language distribution, and account information, reflecting an organized nature rather than a spontaneous interaction.

Analyzing contemporary protests in countries such as Iran now demands more than just an examination of on-the-ground facts. It also necessitates a deconstruction of the digital frameworks that construct their global narratives, requiring answers to critical questions: Who is driving the hashtags? What are the geographical origins of the accounts? What are the key themes and emotions expressed? And how significant is the disparity between the lived reality and the perception created on social media?

One of the most prominent conclusions of the report is the need to deal cautiously with digital indicators – such as the number of posts, reach, and interactions – and not consider them a direct reflection of public opinion, but rather as data susceptible to engineering and manipulation by conflicting parties.