In one of the most significant exposes regarding the Iranian political landscape in the digital age, the US-based cyber intelligence firm Treadstone 71 has released a technical report that shatters the narrative of “online popularity” surrounding Reza Pahlavi, the son of the former Iranian dictator. The report, backed by irrefutable digital forensic evidence, reveals that the Islamic Revolutionary Guard Corps (IRGC) and the Ministry of Intelligence (MOIS) are behind a massive network of automated bots designed to artificially inflate Pahlavi’s profile, aiming to hijack the trajectory of the popular uprising and distract from the democratic alternative. This is not mere speculation; it is mathematical proof. The investigation uncovered hundreds of thousands of accounts “born” at the exact same second, operating with a mechanical precision impossible for human beings.

Un ancien otage dénonce l’hypocrisie de Téhéran et le train de vie confortable des enfants de hauts responsables du régime iranien #IranProtests #IranRevolution #FreeIran2026 #No2ShahNo2Mullahshttps://t.co/6M9WLUSG1p

— Iran Focus (@Iran_Focus) January 27, 2026

The “Metronome Heartbeat”: A Forensic Impossibility

At the core of the report is the discovery of a technical pattern Treadstone 71 terms the “Metronome Heartbeat.” In analyzing data from hundreds of thousands of accounts promoting the monarchy and attacking the Iranian Resistance, cyber experts found a statistical anomaly that serves as a digital smoking gun:

• Over 356,000 accounts were created at time intervals matching with millisecond precision.
• These accounts were not created randomly, as human users would sign up. Instead, they were generated at the exact “00” second of every minute, in rigid 60-second intervals.

The report states unequivocally: “Humans do not sign up like clockwork. Bots do!”. This specific “fingerprint” confirms that the operation was programmed via automated scripts, likely running on server farms managed by state-level actors.

Anatomy of a Mirage: 9 out of 10 Accounts are Fake

The report delves into the specifics of this “cyber farm” working in favor of Reza Pahlavi, revealing that the numbers often cited as proof of his support are nothing more than a digital mirage:

1. Staggering Fake Rates: Forensic analysis of Instagram accounts promoting Pahlavi revealed that approximately 90% (specifically 88.6% in the studied sample) were fake bot accounts.
2. The “Proxy” Campaign: The highly publicized “Man Vekalat Midaham” (I give my proxy) campaign, which urged Iranians to designate Pahlavi as their representative, was the product of “Deceptive Amplification.” The report found that the vast majority of hashtags and engagement for this campaign were driven by these automated accounts triggered at specific times.

Characteristics of the IRGC Cyber Army

Treadstone 71 provided a detailed breakdown of the characteristics that identify these accounts, making it easier for observers to spot the deception:

• Alphanumeric Names: Accounts often use randomly generated handles (e.g., user847392), indicative of auto-generation scripts.
• Missing Identity: Most accounts lack real profile photos or use generic stock images.
• follower/Following Ratio: These bots typically follow a high number of accounts to boost others’ numbers but have zero or very few followers themselves.
• Creation Spikes: The report mapped massive spikes in account creation that coincided with specific political events (e.g., June 2022, September 2022, January 2023), confirming they are switched on and off centrally.

The Strategic “Why”: Why Does the Regime Support the Shah’s Son?

This leads to the critical question: Why would the IRGC and the regime’s intelligence apparatus build a cyber army to support the son of the deposed Shah? The answer lies in the strategy of “Controlled Opposition.” The report and subsequent political analysis suggest several key objectives for the regime:

1. Marginalizing the Democratic Alternative:

The regime understands that its existential threat comes from organized, democratic forces like the NCRI and the Resistance Units. By artificially inflating Reza Pahlavi, the regime creates a “straw man” opposition. They aim to convince the West and the internal population that the only alternative is a return to the past, thereby overshadowing the forward-looking democratic movement.

105e semaine de la campagne « des mardis contre les exécutions » dans 56 prisons iraniennes #IranProtests #IranRevolution #FreeIran2026 #No2ShahNo2Mullahshttps://t.co/TJvBmhcFhb

— Iran Focus (@Iran_Focus) January 27, 2026

2. Sowing Division:

These bots do not just praise Pahlavi; they are programmed to launch vicious, coordinated attacks against other revolutionary forces. The report notes this behavior creates a “toxic polarization” in the online space, designed to exhaust real users and fracture the unity of the opposition.

3. Distorting the Uprising’s Narrative:

While the streets chant “Down with the Oppressor, be it the Shah or the Leader (Khamenei),” the cyber army floods social media with pro-monarchy slogans. This distorts the true demands of the revolution and serves the regime’s narrative that the protesters are merely seeking a return to dictatorship, which helps the regime justify its crackdown.

Deceptive Amplification: Manufacturing Consent

The report explains “Deceptive Amplification” as a psychological warfare technique. Social media algorithms prioritize content with high engagement. When 350,000 bots interact with a Pahlavi post simultaneously, platforms like X (Twitter) and Instagram promote it as a “trend” to millions of real users. In doing so, the IRGC creates a “false reality,” misleading Western journalists and policymakers into believing there is groundswell support for the monarchy, when in fact, the noise is generated by server racks in Tehran.

Conclusion: The Mask Falls

The Treadstone 71 report confronts the international community, tech giants, and the Iranian public with a stark reality: The so-called online popularity of Reza Pahlavi is an intelligence operation run by the very regime the people are trying to overthrow. The astronomical follower counts and trending hashtags are digital smoke and mirrors. They are designed to obscure the truth that the Iranian people reject the “Mullahs’ dictatorship” just as firmly as they reject a return to the “Shah’s dictatorship.” This revelation places a burden on platforms like Meta and X to remove these accounts for violating policies on “Coordinated Inauthentic Behavior,” and serves as a warning to the world not to mistake the noise of IRGC bots for the voice of the Iranian people. The truth of Iran is written in the streets by the blood of protesters, not in the algorithms of the regime’s cyber squads.

The findings of an extensive investigation conducted by The Guardian recount the catastrophic dimensions of the bloody crackdown on Iran’s nationwide and national uprising in January 2026. The report, presenting horrific evidence of mass killings, the collapse of the healthcare system, and mass graves, shows how the Iranian regime, under the cover of a complete internet shutdown, turned Iran into a killing ground over the course of two days. According to The Guardian’s report, the wave of violence sharply escalated starting on Thursday, January 8, reaching dimensions unprecedented in Iran and possibly in contemporary world history.

UN Special Rapporteur: Iran’s Protest Crackdown Among the Most Brutal in Modern History

Fear of hospitals and clandestine treatment

On that day, the mobile phone of a doctor in a not-so-large Iranian city, identified in the report under the pseudonym “Dr. Ahmadi,” was ringing constantly. Throughout the week, protesters injured by batons and pellet weapons were taken to hospitals by police forces, but medical staff believed that many wounded young people avoided going to hospitals because they feared that being registered as trauma patients would lead to their identification and arrest. In response to this situation, Dr. Ahmadi and his spouse secretly began treating the wounded at a location outside the official state hospital system; through an informal local network, injured young people were directed to them.

The sudden change in the nature of injuries

At first, most injuries were superficial, wounds that required stitches and antibiotics. However, as the hours of Thursday evening, January 8, passed, the number of people seeking treatment steadily increased. According to The Guardian, the next day everything suddenly changed. Protesters kept coming, but this time their injuries were far more severe: gunshot wounds from close range and deep injuries caused by bladed weapons, often targeting the chest, eyes, and genitals.

Reports and Horrific Accounts of the Massacre of Protesters and Coup-De-Grace Shots In Hospitals

Unofficial death toll and doctors’ estimates

Dr. Ahmadi told The Guardian that he was shocked by the number of those killed, noting that in that small city alone, more than forty people had lost their lives. Due to the complete internet shutdown, no one had a picture of the overall situation across the country. To map the national scale of this violence, Dr. Ahmadi formed a network consisting of more than eighty doctors and medical staff across twelve of Iran’s thirty-one provinces. This network shared its observations and data to obtain a more accurate picture of the scale of the killings. The assessments by these doctors, shared with The Guardian and supplemented by accounts from morgues and cemeteries across Iran, show that all official and public figures are “severely below the reality.” These doctors have refrained from giving a definitive figure, but they believe that the deaths officially recorded likely account for less than 10% of the real toll. By comparing the number of killings, they personally witnessed with typical hospital statistics, they estimate that the true number of those killed may exceed 30,000 people.

Concealment and the disappearance of bodies

The Guardian’s report also points to organized efforts to conceal the true scale of the casualties. Accounts from morgues, cemeteries, and hospitals across Iran describe bodies being transported in food delivery trucks and meat transport vehicles, the rushed burial of corpses, and the disappearance of hundreds of bodies from the country’s forensic medicine system. At one morgue, staff said that several trucks filled with bodies arrived, a volume far beyond the storage and refrigeration capacity of that facility. When staff objected that it was impossible to handle that many bodies, two trucks carrying corpses were transferred to another location.

Videos and eyewitness testimony of mass burials

Verified videos from the Kahrizak forensic medicine center in Tehran, reviewed by The Guardian, show similar scenes, including what appear to be hundreds of bodies placed outside the facility and families searching among them for their loved ones. The Guardian also spoke with three independent witnesses who reported mass burials and the accumulation of hundreds of bodies at Behesht-e Sakineh cemetery in the city of Karaj, about fifty kilometers west of Tehran. In a written account shared with The Guardian, a person using the pseudonym Reza said that on January 10 and January 11, hundreds of bodies described as “unidentified and unclaimed” were transferred to this cemetery. According to him, many of the bodies were transported in pickup trucks usually used to carry fruits and vegetables, and not all of them were placed in proper body bags.

The digital iron curtain and internet shutdown

The report emphasizes that the widespread internet shutdown played a key role in keeping the true scale of the massacre hidden. Images of bodies have only leaked out through illegal satellite communications, while families have been left unable to learn the fate of their loved ones, as hospitals and forensic medicine centers have collapsed under the unprecedented volume of victims.

As speculation has intensified in political and media circles about the possibility of U.S. military action against the Iranian regime, Yemen’s Houthis and Iraq’s Kataib Hezbollah, two proxy groups of the Iranian regime, have adopted threatening positions and declared that they are ready to enter the conflict. According to the Associated Press news agency, the Houthis of Yemen threatened on Monday, January 26, that they would resume their attacks on ships in the Red Sea. The group also released images of a ship on fire and wrote in the caption: “Soon.” The Associated Press wrote that this threat was likely issued in response to the strengthening of the U.S. military presence in the region and the increased likelihood of action against the Iranian regime.

Hezbollah Turns to Drug Trafficking in Venezuela as Support from Tehran Dries Up

Shortly after the start of the Hamas-Israel conflict, the Houthis began attacking international shipping in the Red Sea, the Bab al-Mandab Strait, and the Gulf of Aden, endangering maritime security in the region. The group has also repeatedly attempted to target Israeli territory. After a ceasefire was established in the Gaza war, the Houthis ended their attacks in regional waters, but they have consistently warned that they are ready to resume their destabilizing actions if deemed necessary. Reports indicate that the USS Abraham Lincoln aircraft carrier has arrived in the Middle East and has been deployed near Iran. On the other side, Esmail Baghaei, spokesperson for the Iranian regime’s Ministry of Foreign Affairs, responded to the possibility of a U.S. attack by threatening that Iran’s government would “certainly respond decisively, with full force, and comprehensively.”

Kataib Hezbollah of Iraq threatens a “large-scale war”

Abu Hussein al-Hamidawi, the secretary general of Iraq’s Kataib Hezbollah, said in a statement—echoing the positions and rhetoric of Iranian regime officials—that a battle with the Iranian regime would not be easy. He described the support of the “forces of resistance” for Iran’s regime as “necessary” and called on the “brothers in the east and west of the world” to be ready for a “large-scale war” in support of the Iranian regime. Hamidawi added that the “mujahid brothers” must prepare themselves for “one of two good outcomes, martyrdom or victory.”

U.S. Designates Four Iran-Backed Proxy Groups in Iraq as Terrorist Organizations

“Axis of Resistance” is the term used by officials and media of the Iranian regime to refer to armed groups supported by Tehran in the region, such as Hamas, Palestinian Islamic Jihad, Hezbollah, Iraq’s Popular Mobilization Forces (Hashd al-Shaabi), and Yemen’s Houthis. These remarks by the Iraqi militia figure about developments in Iran come as the Iranian regime has in recent weeks accused protesting citizens of links to “foreigners” and “enemies,” and has described international support for the Iranian people’s national revolution as “interference” in its internal affairs. CNN had previously reported that Kataib Hezbollah and several other Iraqi armed groups had sent their forces to Iran to assist the Iranian regime in the deadly suppression of protesters.