An Iran-aligned account, donation-funded propaganda, and the voices that carried it
The whole finding before I show how each piece is established. The theme is blunt: Americans with large audiences are amplifying, and in one case celebrating, Iran-aligned regime propaganda that maligns the United States and its administration and traffics in antisemitism. The account, its content and its money are directly verified; each amplification is graded on its own; and the one thing I hold open is knowledge: whether any amplifier acted knowingly.
Hover/tap any finding for the detail behind it.
- The account is a verified, Iran-based propaganda channel. Proven · High + details @AI_IRAAN ("AI IRAN") is blue-check verified, lists its location as IRAN, and follows exactly two accounts, both official Khamenei handles (Supreme Leader Ali Khamenei's and Mojtaba Khamenei's).
- Its content glorifies Khamenei and attacks the US, Israel and Jews. Proven · High + details Posts include "WE ARE ALL KHAMENEI," a Khomeini "KILL US" tribute, "United States of Israel," "Picture tomorrow with Zionism gone," and a video depicting elites drinking blood before a Baal idol over a Star-of-David US map.
- The propaganda is the product; donations fund it. Proven · High + details The account solicits crypto donations across Bitcoin, Ethereum, Solana and TRON, runs a hosted "Lego Videos Team" donation page, and sells the same content as music under the Spotify artist "Mo Shah."
- It belongs to an operation attributed to the Iranian state. Probable · Moderate + details My own prior reporting and Global Affairs Canada both linked the AI "LEGO" operation to the Iranian state; @AI_IRAAN produces the identical format and themes and self-locates in Iran. Whether it is that operation's own account or a copycat inside it is assessed, not proven.
- Cenk Uygur promoted it, and openly celebrated it. Proven · amplification Knowledge open + details He quote-posted the "Stinky Donny" video to ~892K followers and called his own co-host Ana Kasparian's cameo in it "an honor to be Lego-fied," publicly celebrating an appearance in Iran-aligned regime propaganda; his network separately platformed the video's makers on camera. The act is documented; whether he knew its Iranian-state provenance is not.
- Ryan Rozbiani amplified it and asked his audience to "support" it. Proven · High + details He posted four AI IRAN propaganda stills and drove traffic to the off-platform video; the account replied with a heart.
- Candace Owens' show praised the LEGO propaganda genre. Proven · show feature This account: attributed + details On 30 July 2026 @candaceoshow posted an eight-minute segment, "Iran's Lego Propaganda Videos WIN The Internet" (268K views). Whether it showed this specific account is not established; viewers then arrived on its videos commenting "Here because of the Candace Show."
- State command of this specific account stays open. Open + details The operation's state nexus is documented; direct Iranian tasking of @AI_IRAAN itself rests on no direct evidence and is neither asserted nor excluded.
The account, its content, its money, the direct amplifications and the Candace segment are verified. The operation nexus and the segment-to-this-account path are graded Probable; direct state command stays Open.
State, operation, account, content, amplifiers
The chain, left to right: Tehran, the operation it runs, the account inside that operation, the content it makes, and the American voices that carried the content into the mainstream. Solid arrows are proven links; dashed are assessed.
(SGI + GAC)
membership assessed
publishes
· "supported"
The strongest links are the account, its content and the captured amplifications; the weakest is direct state command of this specific account, which stays open. Full state-nexus sourcing is in §07.
Who carried it to a mainstream audience
This is the report's core, and its uncomfortable center: US commentators with large audiences carrying Iran-aligned regime propaganda to the mainstream. Each name marks a documented act, graded on its own evidence.
The network map: all channels on one graph
The account's connected network on one graph: who it follows, who amplified it, who it solicited, and the two channels that bridge to a specific actor, YouTube (to Candace Owens) and Instagram (to the inauthentic liker layer under review). Solid edges are proven and directed; dashed edges are assessed, attributed, or solicitation attempts. Drag any node; hover an edge for the relationship.
The account's own follow graph and outbound engagement make it a purpose-built broadcast node with a deliberately tiny, telling set of ties.
The amplifiers, case by case
On 7 August 2026 Uygur quote-posted the "Stinky Donny" video: "Fun @AnaKasparian cameo in this one! It's an honor to be Lego-fied." He is not merely relaying it, he is celebrating an appearance in it, in a series (§04–05) that mocks American war dead and stages blood-libel imagery. His post drew ~250K views; the video, 487K. His network separately platformed the video's makers on camera. Whether he knew its provenance is open.
On 6 June 2026 Rozbiani posted four AI IRAN propaganda stills with: "Check out the cameos. Support the video they are not on X," driving his audience to the video's off-platform home. This is a two-way tie: he follows @AI_IRAAN, and one of the account's only two outbound engagements ever is a heart reply to him. His bio states his "reposts are informational, not endorsements."
On 30 July 2026 her show account posted an eight-minute segment titled "🇮🇷🧱 Iran's Lego Propaganda Videos WIN The Internet" (268K views, 6.7K likes); the praise is the title's own. Whether the segment showed this specific account is not established; viewers then arrived on its videos commenting "Here because of the Candace Show," a path that is attributed, not proven. view the segment post ↗
Rozbiani: "Support the video," four propaganda stills, AI IRAN hearts it. · view on X ↗
Her show's own post: "Iran's Lego Propaganda Videos WIN The Internet." · view on X ↗
The account's baseline is a few hundred to a few thousand views per post. The video an 892K-follower host quote-posted cleared 487K, and the account's other recent breakout, the Vance video, reached 282K, both orders of magnitude above its floor. That is the distribution mechanism working: niche state-aligned content reaches a Western audience it cannot reach alone. I measure capacity (reach), not persuasion.
The wider sweep: who else quote-posted the viral videos
I pulled the full quote-post pool on the account's two highest-reach videos (the 487K "Stinky Donny" and the 282K "Dance Dance Monkey Vance") and read every quote to classify it. This is a discipline point as much as a finding: raw engagement pools are noisy, and I name a person only where their own words show support, not merely that they touched the post.
Quote-posting "Stinky Donny," Adams wrote: "This channel has a better understanding of the war than anyone watching Fox News, that's for sure." An unhedged endorsement to a 395K-follower verified audience.
Below that tier is a long enthusiast tail: dozens of smaller accounts amplifying approvingly ("absolutely legendary psychological operations and wartime propaganda," "pure gold, one of my faves of all time," "the only ethical use of AI," "banger"), and repeated tagging of @RealCandaceO and her show handle @candaceoshow underneath the videos, which matches the audience influx around her segment. I do not name the tail individually; it is organic supportive spread, not a coordination finding, and I ran no authenticity pass on it.
On X, tested: no coordination signal. I pulled the repost pool of the 487K video and tested it directly. Account creation years span 2008 to 2026 with no cluster (about 4% created in 2026); repost timing spreads evenly across 30 hours with no burst, and much of it precedes the Cenk quote-post; handles show no shared template family (the ~20% name-plus-digits rate matches X's default suggested handles); about 5% of the sampled pool is suspended or unavailable, ordinary attrition. The read on X is organic, ideologically-aligned spread.
On Instagram, the picture differs. A subset of the likes on the account's Instagram posts traces to templated, recently-created, Iran-based accounts carrying no profile image, a shape consistent with an inauthentic engagement layer rather than organic reach. That thread is the subject of separate, ongoing SGI investigation and is not detailed here; I flag its existence, grade it Probable, and hold the specifics. The split, in one line: on X the amplification is American and organic; on Instagram it is inauthentic (assessed).
Khamenei glorified, America and Israel as the enemy
The account's own reach is modest on most posts, a few hundred to a few thousand views. Every video that broke out of that range did so inside a US-amplification window; the gold bars mark them. That is the report's point in one chart: American amplification made the regime's propaganda visible at a scale it never reaches alone. The chart below is each post's view floor; the exhibits show what the videos actually depict.
Broke out inside a US-amplification window The account on its own
View floors are X-reported per-post figures, reviewed to 7 August 2026. One anomaly: the Epstein video's 148K views sit on a near-empty engagement pool (19 reposts, 96 likes, 6 quotes), so that reach did not come from visible resharing; the delivery mechanism is outside external visibility.
"WE ARE ALL KHAMENEI." · view on X ↗
Flag-draped US coffins in the "Stinky Donny" series. · view on X ↗
"WARMART": the US as arms profiteer. · view on X ↗
Rubble-and-children imagery in the same series. · view on X ↗
The recurring cast: Khamenei glorified; the US President ("Stinky Donny"), Vice President ("Monkey Vance") and Secretary of State ("Little Marco") mocked; American war dead and "WARMART" arms profiteering; the Strait of Hormuz "closed." A Khomeini tribute post reads "KILL US … our nation will awaken."
Not "anti-war": the content trades in antisemitic conspiracy
A bias call has to be shown, not asserted. Below are the account's own posts, linked to source, mapped to the kind of examples the IHRA working definition lists. I quote the literal language; I do not soften it.
The posts, in their own words
- "Picture tomorrow with Zionism gone…", eliminationist framing of a people/state. view ↗
- "United States of Israel", the dual-loyalty / foreign-control trope applied to the US government. view ↗
- The "Baal" video, suited elites drinking blood before a horned idol, over a US map whose states are Stars of David, ringed by Masonic symbols: classic blood-libel and secret-cabal conspiracy. view ↗
- The Spotify arm ("Mo Shah") lists a track titled "Picture Tomorrow with Zionism Gone."
These map to IHRA-style examples: dehumanizing/eliminationist rhetoric, the "controlled government" conspiracy, and blood-libel imagery. The content is antisemitic on its face, quoted and linked. Who sponsors the account is a separate question, handled in §07.
Verified, Iran-based, and built to broadcast
This is not an anonymous shell. It is a blue-check account that tells you where it stands: it locates itself in Iran and follows nobody but the Supreme Leader. Its shape (few posts, two follows, heavy media) is a purpose-built broadcast asset, not an organic personal account.
@AI_IRAAN · "AI IRAN"
1893713342981648384linktr.ee/ai_iraan → IG, TikTok, YouTube, X, Spotify, crypto
Where it lives, and how far it reaches
The persona runs across every major platform under a single "AI IRAN" brand and an Iran-flag identity, funneled through one link hub. Instagram carries the largest standing audience; X carries the viral spikes.
Instagram@ai_iraann
TikTok@ai_iraan + backup
Spotifyartist "Mo Shah"
Telegram"AI IRAN"Counts are platform-reported floors reviewed to 7 August 2026; the account's live X follower count fluctuates (≈1,900–2,800 across captures). The peak figure is a single-post reach floor, not an audience.
On the X-specific stealth-attribution checks, @AI_IRAAN returns a null "account based in" and an empty client-source field. Those are partial signals only: the account posts at low volume in one primary language, so I do not flag it as an automated bot. What its shape supports is narrower and firmer: a purpose-built broadcast asset (17 posts, two follows, near-pure media) rather than an organic personal account. On Instagram, the audience is a different question, and the answer is not clean (see §03).
The "LEGO" genre is a state-linked operation: my own reporting and Canada's government both concluded it
@AI_IRAAN did not invent this format. It is one node in a wider Iranian AI "LEGO" operation that my own prior ShadowGraph Intelligence reporting established as state-linked and Canada's government independently confirmed.
My own prior ShadowGraph Intelligence investigation traced the AI "LEGO" operation to a Tehran outlet, "Explosive Media" (Akhbar Enfejari), and identified M. Taha Ansari Mohseri, a figure in the social-media orbit of a top adviser to the Supreme Leader, as central to it. Global Affairs Canada's Rapid Response Mechanism independently reached the same conclusion: in a report first issued 11 May 2026, it "has directly linked to the Iranian state, through open-source analysis, the ongoing viral information operation using AI Lego-style figures," assesses the outlet likely linked to that same adviser at Iran's Supreme National Security Council, estimates at least 83 million first-month views ("likely 200 million" counting removals), and flags "a growing number of copycat creators." The outlet denies state links and solicits audience support through crypto donations, the same posture and funding model @AI_IRAAN runs. Independent coverage runs the same way: 404 Media, The Conversation, and the Institute for Strategic Dialogue. That attribution names who runs the operation @AI_IRAAN imitates, not who runs @AI_IRAAN.
The operation’s own brand: "PersiaBoi x Explosive Media," recruiting under the "LEGO Resistance Front" banner. Captured in my prior investigation (SGI-2026-ATT-004). · open the companion report →
@AI_IRAAN produces the identical format, themes, funding posture and Iran-flag identity attributed to the state-linked operation, and RRM Canada expressly flags "a growing number of copycat creators." At minimum it operates inside the Explosive Media ecosystem; whether it is one of the operation's own handles or an imitator is unresolved, so membership is graded Probable. The resolving step is in §10.
Donation-funded, on public rails
The propaganda is the product; donations support it. The link hub routes to a hosted crypto pay page and donation wallets on four blockchains, all readable on public explorers; the posts themselves do not ask for money. The balances are small; the point is the traceability.
The link hub: "Donate via Wallet Address," Spotify "Mo Shah," and a Paymento pay page. · view ↗
The audio arm "Mo Shah": the video titles, sold as songs. · search ↗
Balances read to 7 August 2026 from public explorers (mempool.space, Etherscan, Solscan, Tronscan). The Spotify track list, "Losers First," "Little Marco," "Picture Tomorrow with Zionism Gone," "Epstein Scar", matches the X video titles, tying the "Mo Shah" artist page to @AI_IRAAN. Crypto donation, from a sanctioned jurisdiction, is exactly the funding posture RRM Canada describes for the operation.
I pulled every wallet's full transaction history on 8 August 2026: six inbound transfers across all four chains, a few hundred dollars total ever received, and not one outbound transaction. Whatever this account is optimized for, it is not donations. The rails still matter: with legal process and commercial blockchain analytics of the kind Chainalysis provides, every deposit origin and any future cash-out stays traceable, and exchange KYC can convert the pay page into a named account holder (§10).
What the operation did, and where I could not see
The threat-intelligence spine. Findings are mapped to Meta's Online Operations Kill Chain, the industry-standard framework Meta published in 2023 for analyzing online influence operations, each phase with an evidence basis and a confidence tier; the phases I could not establish are marked rather than hidden.
| Kill-chain phase | Observation | Basis | Confidence |
|---|---|---|---|
0 · Acquire assets | Verified X account (created Feb 2025) plus Instagram, TikTok, Telegram, YouTube, Spotify and a Linktree, under one "AI IRAN" brand. | Platform metadata | Proven |
1 · Disguise assets | Iran-flag identity; Instagram history shows a prior username "aisammii"; Spotify arm runs under a different name ("Mo Shah"). | Username history | Proven |
2 · Gather information | Not observed for this node. | n/a | Not observed |
3 · Coordinate / plan | Content and titles mirror the Explosive Media operation; whether that reflects coordination or copying is unresolved. | Content parallels | Pattern-only |
4 · Test defenses | Not tested; also rarely observed even in confirmed operations. | n/a | Not tested |
5 · Evade detection | Low-post broadcast footprint; drives traffic off-platform to YouTube ("they are not on X"); reposts under fresh titles. | Post record | Probable |
6 · Indiscriminate engagement | High-frequency cross-platform posting of AI video + matching audio releases. | Post + Spotify record | Proven |
7 · Targeted engagement | Named-target videos (Trump, Vance, Rubio, Hegseth); two posts reached 282K–487K after US-commentator amplification. | Post metrics | Proven |
8 · Compromise assets / finance | Donation wallets on 4 chains + a hosted pay page, held in the link hub rather than pushed in posts; one BTC wallet funded from a batch payout. Ad spend is outside external visibility. | On-chain explorers | Proven / Outside visibility |
9 · Enable long-term persistence | Backup account ("back up of ai_iraan" on TikTok); multi-platform redundancy survives single-platform removal. | Profile metadata | Proven |
· State command of this node | Operation-level state link is documented (SGI + GAC, §07); direct tasking of @AI_IRAAN specifically is not established. | Collection boundary | Not established |
Swipe sideways to see basis and confidence →
Context: the US-Iran conflict and the Epstein discourse the content exploits (observed). Motive: pro-Iran narrative dominance, a reasonable read of the content, but a hypothesis for this node, not a measured fact. Content: Khamenei glorification, anti-US targeting, antisemitic conspiracy (observed, §04–05). Consequences: reach capacity measured; downstream belief or behavior change not measured, capacity is not impact. Cycle: the observed amplification loop is mainstream-commentator pickup (§03), which is what moved this content off its baseline.
Pseudonymous, with leads, and a lawful way to a name
The operator behind @AI_IRAAN is not publicly named, and I do not name one here. What the collection supports is a purpose-built account with several identity leads, each labeled by strength, and a clear, lawful next step to formal confirmation.
a and ending 8 (a***8@gmail.com) plus a masked back-up on TikTok. The "a" prefix is consistent with the former username "aisammii." Leadiranavengers110@gmail.com surfaced in adjacent collection; its "i" prefix does not match the X "a…8" vector, so it stays a lead, not a link. 🟡 LeadFormal identification is available without any invasive collection: platform legal process (a preservation letter plus a subpoena) for the registration and recovery records behind @AI_IRAAN and its sibling accounts, and exchange KYC process on the four donation wallets, which convert an anonymous pay page into a named account holder. That is the step that turns these leads into a name.
The competing readings, ranked
Discipline means saying what else could be true and why I rank it where I do. Three hypotheses, most to least likely on the record reviewed.
What would shift the ranking: shared analytics/registration or a co-author tag linking @AI_IRAAN to Explosive Media (would push toward H1 as the same operator); wallet KYC showing a non-Iran commercial operator (would lift H3). None of that is in hand, which is why membership is graded Probable and same-operator identity is left open.
The line, drawn explicitly
I claim
- @AI_IRAAN is a verified, Iran-based account that follows only Khamenei and publishes Khamenei-glorifying, anti-US and antisemitic AI "LEGO" content.
- It solicits crypto donations across four chains and a hosted pay page, and sells the content as music ("Mo Shah").
- It belongs to the Iranian state-linked "LEGO" operation that my own reporting and Global Affairs Canada both attribute to Tehran (membership Probable).
- Its content maligns the United States and its administration and pushes open antisemitism.
- Cenk Uygur and Ryan Rozbiani directly amplified it, and Uygur publicly celebrated his own show's cameo in it; Candace Owens' show posted an eight-minute segment titled "Iran's Lego Propaganda Videos WIN The Internet."
I do not claim
- That any amplifier is an agent of Iran, was paid, or knew the content's provenance.
- That the Iranian state directly commands this specific account (documented at the operation level only).
- That @AI_IRAAN is the same operator as Explosive Media, absent shared-infrastructure proof.
- That Candace Owens' segment showed this specific account; her viewers' arrival is attributed by their own comments.
- That the X resharing audience is inauthentic: the repost pool tested organic for coordination, and per-account authenticity was not scored. Instagram is different: a subset of its likers is assessed inauthentic (§03).
The takeaway
An anonymous Iranian propaganda channel is, on its own, a small thing: a verified account with a couple thousand followers, a handful of posts, and a few dollars of crypto in four wallets. What made it consequential was not Tehran's production budget but the Western distribution it was handed. This is the theme worth sitting with: Americans with large platforms carried Iran-aligned regime propaganda, content that glorifies Khamenei, mocks American leaders over their war dead, and trades in blood-libel antisemitism, into the mainstream, and one of them, Cenk Uygur, publicly celebrated his own show's cameo in it. The account and its money are proven, its membership in the state-linked operation is Probable, and direct state command of this node stays open. So does the sharpest question the pattern raises: whether any of these Americans acted knowingly. What is documented stands on its own: the content, the amplification, and in one case the applause.
Because the money runs on public rails and the accounts run on platforms that answer to legal process, the confirming steps are ordinary ones: preservation and subpoena for the registration and recovery records, and KYC process on the wallets. This is the second ShadowGraph Intelligence report on this Tehran "LEGO" operation; the first traced a named US collaborator and the operation's state-media amplification.
I am Travis Hawley. If you are being named, targeted, or amplified by an operation like this one, or you want a narrative traced and attributed, find me at shadowgraphintel.com/contact, @talk2trav on X, and @talk2trav on Instagram. And scrutinize whatever you read next, including me.
How this was done, and where I stopped
The disciplined version of everything above, for the reader who wants to stress-test it.
An evidence-led open-source assessment of one account, its funding, the operation it belongs to, and who amplified it. It is not a legal finding, and I do not adjudicate the underlying war or the Epstein questions the content exploits. Directly verified findings (the account's metadata and posts, the wallets, the captured amplifications) are kept apart from what is assessed (operation membership, the Candace segment-to-account path) and what is open (direct state command of this node).
Account characterization rests on platform-displayed metadata and the account's own posts, cross-checked with commercial social-media monitoring; content findings quote linked posts and map to IHRA-style examples; funding rests on public blockchain explorers; operation attribution rests on my own prior investigation, corroborated by Global Affairs Canada and open reporting, each linked. Collection was passive and lawful: no account was accessed, no reset flow was run, no code was requested or entered.
Every reach figure is a floor, not a census: video and caption-only capture undercount, and counts fluctuate by read date. Operation membership is Probable, not proven; the operator is unnamed pending platform legal process (§10); the X repost pool tested organic for coordination, but per-account authenticity was not scored; the Instagram liker layer is under separate, ongoing investigation (§03). Certain claims remain unverified and this is not a determination of wrongdoing. Companion work on this operation: the "Bullseye Loomer" report (SGI-2026-ATT-004).