A new transparency feature on X showed that a coordinated cluster of Scottish pro-independence personas was operated from inside Iran, according to findings published by the UK Defense Journal.
The platform’s transparency panels now show the cluster accessing X through Iran’s App Store while routing traffic via VPN servers in the Netherlands, UKDJ reported on Sunday.
The outlet said it had tracked a sample of the accounts for months, citing synchronized posting patterns, near-identical creation timelines and AI-generated profile images.
The accounts, analysts said, mimicked Scottish independence supporters but repeatedly boosted pro-Iran narratives.
All accounts tracked by UKDJ also went offline during Iran’s nationwide internet blackout in June, a synchronized silence that had previously been circumstantial but now aligns with the confirmed Iranian connection.
“The initial UKDJ investigation focused on a handful of accounts that appeared at first glance to be ordinary pro-independence users… and all of those under close observation fell silent at the exact moment Iran suffered a nationwide blackout in June,” the UK Defense Journal said.
The new data “provides the proof that was previously unavailable,” the report said, noting that creation dates, username changes and regimented posting rhythms matched across the cluster.
Coordinated inauthentic behavior
UKDJ said the accounts boosted one another within seconds and repeated the same slogans, creating a manufactured impression of a large grassroots movement.
It added that after connectivity in Iran was restored, many briefly resurfaced with pro-Iran or anti-Western messages before switching back to Scottish independence content.
The report said that the findings do not call Scotland’s genuine independence movement into question, but instead illustrate how fabricated personas can skew perceptions of public sentiment.
The findings show “Iran, as well as countries such as Russia and our other enemies, are actively seeking to subvert our democracy and discourse,” Scottish MP Graeme Downie told UKDJ.
Connection to Iran-focused concerns
The revelations emerged as Iranian users vented anger over X’s new location display, which has put a spotlight on tiered internet access and privileged “white SIM cards.”
Journalist Hossein Bastani said the change also exposed pro-government Iranian personas posing as foreign supporters, including an account named “Jessica” that presented itself as a Scottish activist before appearing to post from inside Iran.
UKDJ’s findings mirror similar cases involving Gaza-advocacy personas after X’s transparency data showed several accounts saying to be based in Gaza were in fact operating from Pakistan, London and other locations.
Like the Scottish-themed cluster, those accounts relied on localized imagery and political language until the location tags revealed their origins. Israel’s Persian-language foreign ministry account later branded one such operator a “deceiver.”
Wider pattern of foreign influence
UKDJ said Iranian information operations have repeatedly latched onto divisive political debates in Western democracies, making Scotland’s constitutional question “a suitable channel” for influence activity.
The report has also renewed calls for political actors to vet online material more carefully.
Downie urged parties to be “much more alive to this threat” and to push back against misinformation, including when it is “shared by their own elected officials.”
The feature, rolled out in recent days, appears to flag which accounts are connecting from inside Iran, sparking online claims that some prominent users are posting via so-called “white SIM cards” – privileged, unrestricted mobile lines widely believed to be reserved for senior officials or security-linked bodies.
“A new feature on the X platform that displays users’ approximate locations has revealed that many Islamic Republic officials, pro-government activists, and affiliated journalists have access to privileged internet,” political activist Hossein Ronaghi said in a post on X.
“This means they are using unrestricted, unfiltered internet despite the censorship, through so-called white SIM cards.”
White SIM cards are special lines exempt from state filtering policies, enabling uninterrupted access to platforms blocked for most of the population, including Instagram, Telegram and WhatsApp.
Over the past year, officials have floated extending this kind of unrestricted access to tourists and some technical specialists, while political insiders and parts of the media are now widely understood to already use such lines.
Public anger quickly focused on high-profile figures whose X profiles showed Iran as their connection country, including former and current lawmakers, government’s spokeswoman and several media personalities – even as some of them had previously said online that they use VPNs.
Users argued that if those individuals were genuinely connecting through VPNs, their accounts would not still appear to be logged in from inside Iran.
They said the discrepancy undercut those figures’ past public frustration over internet filtering and raised fresh questions about whether they had access to privileged lines.
Critics also pointed to the accounts of former TV host Reza Rashidpour and news presenter Elmira Sharifi-Moghaddam, whose profiles displayed Iran as the country of connection.
Many accounts linked to pro-government figures, however, changed their region settings shortly after the controversy escalated.
Government spokesperson Fatemeh Mohajerani, who had previously been asked whether she used an unrestricted line, said she relied on VPNs.
“I use filters like everyone else, and my son and daughter-in-law help me with the setups,” she said in response.
After screenshots circulated showing her apparent connection country as Iran, users accused her of being dishonest.
One user pointed to the location on the account of Amirhossein Sabeti, a lawmaker and a staunch supporter of internet filtering, and – mocking his use of an iPhone – wrote: “An American phone, an American app, white internet. What he prescribes for the public: ‘resistance economy.’”
Another user on X wrote: “These days the truth doesn’t stay hidden. It pops out through locations and exposes who is breathing under the shelter of a white SIM card and who is choking in the cage of filters.”
Technical doubts complicate the debate
Other users pushed back, posting screenshots showing X still listed Iran as their connection country even while they said they were using VPNs.
The digital-rights group IRCF echoed that point, warning that some widely used circumvention tools can leak signals that leave a user’s underlying Iranian connection partly visible.
“If you are using popular protocols like Warp or Mask, or serverless configurations, the Iran country tag can still appear because the underlying IP originates from Iran,” IRCF wrote in a post.
“This does not necessarily mean the person has white internet, though it can still be one factor in a broader assessment.”
An Iranian trainer at X called Shayan, identified by users as working on the platform’s infrastructure, also described “exceptions and bugs” that can affect the region display.
“If the location shows Iran without an alert icon, it usually means the user is reaching X with an Iranian IP.”
“I’ve seen people say that if someone uses Warp, Mask, serverless services or similar tools, their IP still shows as being in Iran and it’s not considered a white line. However, I don’t have precise information about this,” he said in a short exchange.
X itself has said that the Country/Region indicator may be imprecise and can be influenced by VPNs, proxies or default settings of local internet providers.
Politicized arguments escalate
The controversy quickly swept through Iran’s polarized social media sphere. Former government adviser Abdolreza Davari said that some anti-government accounts posting from inside Iran were themselves using white SIM cards.
Journalist Hossein Bastani, meanwhile, pointed to pro-government personas whose profiles appeared to connect from Iran despite presenting themselves as overseas supporters.
“One of these self-described Scottish independence activists turns out to be posting from Iran with public funds,” Bastani wrote.
Government-aligned users who dismissed critics as “bots” were met by others noting that many ordinary Iranians mask their IP addresses for safety.
Some also cited cases in which prominent officials’ connection locations later shifted to Middle East or West Asia after the backlash, suggesting changes to account settings rather than definitive proof of privileged access.
Broader frustration over filtering
The intensity of the reaction reflects a deeper public grievance with longstanding filtering policies.
President Masoud Pezeshkian promised relief during his campaign, but aside from the recent unblocking of WhatsApp and Google Play, wider restrictions remain.
Critics said the uproar has thrown a spotlight on the structural inequalities built into Iran’s digital system. Many argue that public anger is less about a single setting on X than about a long-running double standard.
One user, reacting to screenshots that seemed to show Communications Minister Sattar Hashemi connecting from Iran, wrote that people are furious because they are forced to live with filters, and officials step around them effortlessly.
Some activists used the moment to demand universal access rather than selective privileges. “Make all 90 million lines white,” one user wrote.
In a post in Arabic on X, Larijani offered condolences for the deaths, describing those killed as having “reached their wish.”
He said Israeli Prime Minister Benjamin Netanyahu “continues his adventurism to the point that everyone reaches the conclusion that there is no path left except direct confrontation with Israel.”
Hezbollah said the strike on Sunday killed Tabtabai, the group’s top military official, and wounded 28 others.
Israel’s military said it targeted Tabtabai in Beirut’s southern suburbs, calling him a senior official overseeing Hezbollah’s military readiness, in one of the most significant escalations since a US-brokered ceasefire in November 2024.
Iran has condemned the attack as a violation of the ceasefire and a “war crime,” and Hezbollah has said it crossed a “red line,” adding that its leadership would decide how to respond.
The United States designated Hezbollah a terrorist organization and sanctioned Tabtabai in 2016, describing him as a key commander within the group.
“The identity of the godfather and the members of his network is now clear,” the prisoners of Ghezel Hesar facility in Karaj wrote in a report. “There is no room left for denial or claims of ignorance.”
They called on judicial authorities and the Prisons Organization to act “immediately and transparently” to protect inmates and halt the network’s activities.
Network tied to senior prison official
Esmail Farajnejad, Ghezel Hesar prison’s deputy for health affairs, according to the report.
The prisoners said his involvement dates back to his time at Rajaei Shahr prison, where they said he and several associates helped distribute narcotics and other illicit goods.
Farajnejad was later reassigned to Ghezel Hesar, but the prisoners said his reach endured with backing from a senior official they identified only as “Mr. Baay,” who subsequently rose to a powerful internal security role.
The inmates said the network reaped “significant financial gain” from drug trafficking and from securing internal appointments that kept its members in key roles.
Farajnejad, they alleged, maintained control through threats and intimidation during his tenure.
Ghezel Hesar, one of Iran’s largest and most feared prisons, recorded 183 executions in the last year, the rights group HRANA reported in October.
Role in suppressing recent strike
The prisoners said Farajnejad played a direct role in ending a strike in Ward 2 mid-October, after 15 inmates on death row were moved to pre-execution cells.
They alleged he initially relayed sympathetic messages through prisoners close to him, but hardened his stance as the protest spread.
“He called the prisoners stubborn and uncomprehending,” they wrote, quoting him as warning that executions would go ahead “in groups of thirty” if the strike continued. The inmates said protesters then escalated by sewing their lips shut.
The report ends with a warning that more names tied to the alleged network will be made public if authorities fail to act.
The prisoners said the network’s structure and beneficiaries “are now fully exposed,” and urged officials to intervene to protect those in custody.
