Sibling account · same play
@IRGC_Global
"JUST IN: North Korean leader Kim Jong-Un has announced that if the United States attacks Iran with nuclear weapons, he will launch nuclear ballistic missiles at Tel Aviv and Washington, D.C."
§ 01 · Executive Summary
A coordinated network, hiding in plain sight
What looks like a scattering of independent "news" accounts is one operation: a family of manufactured personas, built on a shared fingerprint, pushing a single foreign-aligned line at scale. Here is the whole thing before I explain how I found it.
The network at a glance: 21 fingerprint-matched personas around the three accounts I started from. Node size is follower count; color is sub-cluster. The faint gold web is follow ties between the accounts themselves: they do not just orbit the three anchors, they follow one another. I counted 71 such ties among the 18 non-anchor accounts, and every one of the 18 is tied to at least one other. The rest of this report is how I found them, their reach, and what they push.
⚑ Platform enforcement · 19 July 2026
Since the review window closed, eight of the 21 accounts have been suspended by X, including the network's two largest: @GBX_Press (157K followers, ~43% of the network's engagement) and @GP_Presss (105K). @SPC_Press, @Expres_Newsx, @TNT_Today, @OpsHQs, @IR_HDX and @Iran__Fire are also suspended, and @SPX_Press's handle no longer resolves — nine of the 21 now gone. The three anchor accounts, @GBC_Press, @IRGC_Press and @IRGC_Global, remain live and posting. Each status was checked account-by-account on X on 19 July 2026; suspended accounts are marked ✕ in the map above and flagged in the roster in §04. Follower, posting and engagement figures throughout this report describe the review window and are unchanged by the suspensions.
X does not disclose why it suspends accounts. But platform enforcement against coordinated networks typically keys on internal signals no outside observer can see — shared registration details, payment instruments, device fingerprints and IP infrastructure: the very records this report notes only legal process could otherwise reach. An eight-account, same-sweep takedown across the cluster is consistent with the platform's own systems linking these accounts at that level. That remains inference: the public record shows the suspensions, not the reasons for them.
I did not set out to map a network. I set out to check one post, a "BREAKING" card from @GBC_Press claiming Netanyahu had threatened Spain, which turned out to be an invented quote laid over a real video that says no such thing. That post was seen 4.3 million times. Checking the account behind it, then the accounts it amplifies, then the accounts those follow, turned one node into a network of at least twenty-one.
The accounts present as unrelated independent outlets. They are not:
- One manufactured fingerprint, shared down to the wording of their bios.
- Created in tight batches, not accreted over years.
- They follow and boost one another across the family.
- One disciplined editorial line: Iran and its allies ascendant; the United States and Israel collapsing, criminal, or humiliated; a layer of pro-Russia and "multipolar" content.
- The identical fabricated-quote-over-video play across several accounts, with the biggest single post in the network reaching over nine million views.
★ The through-line
Twenty-one coordinated accounts, getting billions of views, saving tens of millions of dollars in advertising, to freely push anti-Western, pro-Iran content at the West.
A single fake post is a nuisance. A disposable-branded network manufacturing that content around 760 times a day, from a region known for state influence operations, reaching Western audiences at the scale of a national ad campaign it never had to pay for, is an information-environment problem.
★ Reverse-engineering the true reach
Engagement is only the visible tip: likes, reposts and replies are a small fraction of the people who actually see a post.
Measured
48.6M engagements
on the 21 accounts' posts over six months
÷
Benchmark
0.5–1% engagement rate
X's published benchmark: the share of impressions that engage
=
Modeled
5–10 billion views
estimated for these posts over six months
This network's own top posts sit in that band: the Netanyahu-Spain fabrication drew about 43,000 engagements on 4.3M views, near 1%; the Kim Jong-un fabrication about 15,000 on 4.4M, near 0.35%. The result is a modeled estimate from a standard industry rate, not a measured impression count, presented as a floor-and-ceiling range rather than a single number.
What that reach would cost to buy
The most concrete way to grasp the scale is to price it. Every post in this network is in English and aimed at US and Western readers, and that is the audience advertisers pay the most to reach. So the right benchmark is not X's cheap global average (about $2 per thousand) but its US rate for news and media content, roughly $6 to $7 per thousand impressions.
$30 to $65 million dollars in earned media value (EMV)
That is premium Western-audience advertising the network delivered for free. Buying 5 to 10 billion US impressions on X at about $6.40 per thousand (the going rate for news and media content) would cost roughly $32 million to $64 million. Even at X's rock-bottom global median of about $2 per thousand, the floor is still $10 to $20 million. Whoever benefits from this network is getting tens of millions of dollars of premium Western-audience advertising without paying for a single impression.
This is an earned media value (EMV) estimate, an advertising-value equivalency: estimated impressions multiplied by X's published cost-per-thousand for US news and media content. It is a rough proxy built on the impression estimate above, so treat it as an order-of-magnitude figure, not an invoice. CPM benchmarks: industry rate cards, Hootsuite 2025.
The bottom line
What I found
How the investigation ran: one viral post, to the account behind it, to a same-day cluster, to a network of 21+, to a graded attribution.
- The thread: one fabricated post, 4.3 million views. @GBC_Press laid an invented Netanyahu quote over a real video whose own captions contradict it. That post is where my attention started, not where the story ends.
- The thread led to a network. The account is one node in a family of at least 21 matched personas that follow and amplify each other: three "IRGC" accounts, two GBX/GBC bio-clones, a family of three-letter "_Press" media brands, and a set of Iran- and Russia-branded "news" personas.
- They share one manufactured fingerprint. "West Asia" placement, purchased blue verification, generic press branding, the same "independent / unaffiliated / curated" disclaimer bio, and repeated username changes. @GBX_Press runs GBC's bio almost word for word.
- They were stamped out in batches. Fifteen of the 21 were created in a single Mar–Apr 2026 window; three of them within 37 minutes of each other on 9 April.
- The scale is enormous. Across six months these 21 accounts posted about 137,000 times and drew roughly 48.6 million engagements, with individual posts hitting 4–9 million views. Reverse-engineered from those engagements at a standard X engagement rate, their content was likely seen several billion times.
- The line is disciplined. All of it pushes pro-Iran, anti-US and anti-Israel messaging, plus a pro-Russia / "multipolar" layer, carried on a combined ~640K followers.
- Assessed direction: Iran-aligned, at high confidence. The content and branding point one way. I do not name a sponsor; only platform records obtained by legal process could turn this pattern into a name.
Method note: the network roster is built from the three anchor accounts' follow graphs and per-account metadata via commercial social-media monitoring. It is a floor: a full-population enumeration would extend it.
§ 02 · The Thread I Pulled
The post that started it: 4.3 million views for an invented quote
A real Netanyahu video, an overlaid quote that is nowhere in it, and an account built to broadcast and to reveal nothing about itself. This is the single post that pulled me into the network.
@GBC_Press, in its own metadata
- Handle: @GBC_Press · Name: "GBC Media Network"
- Created: 28 February 2026 · Posts: ~4,460 (~43/day)
- Following 154, followers ~67.8K (a broadcast ratio)
- Verification: blue check, purchased (not org/gov)
- Account based in: West Asia · App: West Asia Android
- Username changes: 7, last June 2026
- Bio: "Curated content and insights covering major events and ideas from diverse perspectives."
The account's posting curve tracks the war itself. It surges through the opening air campaign, falls away under the 7 April ceasefire into a three-month trough, then explodes the moment the ceasefire collapses on 6 July, peaking at 315 posts the day Iran shuts the Strait of Hormuz. That is an event-driven messaging engine, not a person.
What the markers mean
- 28 FebWar begins. The US-Israel air campaign against Iran opens. @GBC_Press is created the same day, and its posting climbs with the fighting.
- 7 AprCeasefire. Major fighting halts. Posting falls away into a roughly three-month trough.
- 9 AprThe 3 anchors created. @IRGC_Press, @IRGC_Global and @IR_Press, the three accounts this investigation started from, are all created on this one afternoon, within about 40 minutes of each other, during the lull. They are the anchors of a wider 21-account network, most of which was built out across this same February-to-April window (full creation pattern further below).
- 6 JulCeasefire ends. Iran strikes vessels off Oman. Daily posting jumps almost at once, from about 120 to 237.
- 9 JulStrait of Hormuz shut ● peak. Iran closes the strait; the account hits its highest single-day volume in the record, 315 posts.
This curve is @GBC_Press's own posting, one account of the 21. It is shown because it is where the thread started, and because its account-creation dates line up with the war's turning points: the anchor is born on the war's opening day, the anchor trio during the ceasefire that followed. The wider network's build-out and reach are mapped in the sections that follow.
Daily posting by @GBC_Press, with the major 2026 Iran war events overlaid. Sources: war timeline and ceasefire reporting.
⚑ Account-integrity read
A purchased badge, a hidden owner, a placement in a region known for state-run influence operations, seven identities in five months, and ~43 uncited "BREAKING" posts a day are not, individually, proof of anything. Together they describe an account built to broadcast at volume and to stay unaccountable. The obvious next question is whether it is alone. It is not.
§ 03 · From One Post to a Network
One account becomes three
The only accounts @GBC_Press directly retweets are two "IRGC"-branded personas, created the same afternoon, forty minutes apart, sharing its exact fingerprint. That was the first tug on the thread.
The core cluster. Solid lines are GBC's directly verified retweets of both IRGC accounts; the dashed line is the IRGC pair's same-afternoon creation, 40 minutes apart.
The sibling account runs the identical fabricated-quote-over-video play: an invented "announcement" over spliced footage, 4.4 million views, from an account barely two days old. Same play, same afternoon-stamped cluster. So I kept pulling, into the accounts these three follow.
§ 04 · The Wider Network
Three accounts become twenty-one
Reverse-enumerating the three anchors' follow graphs surfaces a whole family of matched personas they follow and promote, all carrying the same fingerprint.
The shared fingerprint
The seven markers that recur across the network. No single one is proof; together they are a manufactured template. The full map of these accounts is at the top of this report.
★ The strongest new links
@GBX_Press (157K followers) and @GBX_Global run GBC_Press's bio almost word for word: "GBX | Curated content and insights covering major events and ideas from different perspectives," against GBC's "…from diverse perspectives." The pair even split one avatar design between them: the same red-and-blue roundel, one stamped PRESS, the other GLOBAL. And @IR_Press was created on 9 April 2026 at 13:23 UTC, in the same 37-minute window as @IRGC_Global (12:46) and @IRGC_Press (13:25): three matched accounts stamped out the same afternoon.
The discovered accounts
◆ Members vs targets
These persona accounts are the candidate network: templated brands, no disclosed operator, matched fingerprint. Separately, the anchors also follow genuine Iranian state outlets, which I treat as amplification targets, not members of the covert cluster:
§ 05 · The Network's Reach
This is not a fringe operation
The mapped accounts carry a combined follower base of roughly 640,000, and their biggest individual posts reach into the millions. Reach is concentrated in a few large hubs and spread across many mid-size personas.
The network's largest accounts by follower count (thousands). @GBX_Press and @GP_Presss each carried six-figure audiences; the fabrications they and their siblings post reach 4–9 million views apiece. Both have since been suspended by X (see §01).
Six months of output, account by account
Followers are only the standing audience. The output is the operation. Across the six-month window I measured, the 21 accounts posted about 137,000 times and drew roughly 48.6 million engagements. That is on the order of 760 posts a day, every day, for six months. @GBX_Press alone accounts for around 43% of the engagement; the four busiest accounts carry more than 80% of it.
Every mapped account, ranked by six-month engagement (bar), with its post count alongside. Source: commercial social-media monitoring, 18 January to 18 July 2026. Figures are the platform's rounded totals. @SPX_Press is queried by its account ID, which still returns data under its new handle.
~640K
combined followers across the 21 mapped accounts
9.1M
views on the single biggest post in the network · view on X ↗
4
accounts carrying 50K+ followers each
§ 06 · Where They Say They Are
Almost all of them place themselves in West Asia
X's "About this account" panel reports where each account is based. The pattern is overwhelming and it is a flag, not a sponsor: a region that includes Iran and hosts documented state influence operations.
Placement map. Marker size is the number of accounts placing themselves in each region, via the platform's "About this account" panel.
The same placement as a distribution. Nineteen of 21 place themselves in West Asia or Yemen.
◆ What placement does and does not prove
"West Asia" is a region, not a country, and the platform derives it from access patterns, which a determined operator can shape. It is not proof of who runs the accounts. But a network of "independent" outlets that overwhelmingly resolves to one influence-operation region, while pushing that region's geopolitical line, is a convergence worth stating plainly.
§ 07 · When They Were Built
Stamped out in batches
Authentic media accounts accrete over years. These did not. Creation dates cluster hard into a single spring-2026 window, the signature of a coordinated launch rather than organic growth.
Every account plotted on a creation timeline. Each dot is one account; the red dots are the three created within 37 minutes on 9 April.
The same creation dates as a monthly distribution. Fifteen of 21 fall in the Mar–Apr 2026 window (red).
★ Why batch creation matters
A shared creation window is one of the harder signals to fake and one of the clearest markers of coordination. Independent operators do not, by coincidence, all stand up matched press personas in the same eight weeks. When three of them land inside a single 37-minute window, that is not a pattern any longer, it is a batch.
§ 08 · What They Push
One line: against the US, against Israel, for the Iran axis
The content is not random. Across the reviewed sample it runs one disciplined editorial line, with a pro-Russia and "multipolar" layer, and the emotionally charged anti-US and anti-Israel posts are the ones that travel.
Editorial-line categories, as a share of the reviewed posts. Colored by target: blue anti-US, red anti-Israel, gold pro-Iran axis, grey filler.
The same posts grouped by who the messaging is aimed at. Roughly two of every three non-filler posts attack the US or Israel.
Within the network, Russia-branded personas (@Rusia_HD, @Urgent_Russia24) carry pro-Russia and "multipolar" narratives alongside the Iran line, which is consistent with a single anti-Western operation rather than two separate ones. I flag the pro-Russia content as present and thematically aligned; I do not claim a distinct Russian sponsor.
Example viral content from the network
The two highest-reach posts in the record are a pro-Palestine item (9.1M views) and a fabricated threat (4.4M). Reach concentrates in the influence payload, not the filler. Cards link to the source; @GBX_Press and @GP_Presss have since been suspended by X, so their linked posts may no longer resolve.
§ 09 · How They Connect
The coordination, signal by signal
Zooming back into the core cluster, here is the coordination evidence laid out, signal by signal, drawn from the accounts' own platform records and posts. Nothing here rests on the reshare audience.
Coordination-signal matrix across the three anchor accounts.
The same fingerprint, across all 21
The matrix above proves the three anchors in detail. The signals are not confined to them. Here is how many of the full 21-account network carry each one, checked account by account.
Each bar is a count out of all 21 mapped accounts, verified per account from profile data (region, purchased verification, username-change history, bio wording and avatar artwork) and from the follow graph. @SPX_Press's handle no longer resolves, so verification and avatar could be confirmed for 20 of the 21.
The cluster's shared timeline: account creation events and the fabrications each one produced.
◆ One honest negative
I checked whether the accounts' daily posting volumes rise and fall together, which would be a coordination signal. They do not, consistently: the correlation is moderate for one pair and near zero or slightly negative for others. So the volume curves alone do not establish synchronization, and I do not claim it. The coordination case rests on the follow graph, the shared fingerprint, the bio clone, and the batch creation, not on synchronized posting.
§ 10 · The Fabrication Playbook
Fabrication vs the video
The network's signature move is a quote-card laid over unrelated footage. There is no partisan primary source to argue about: the primary source is the clip the account chose to attach, and it refutes the post.
◆ How to read this ladder
Each rung is graded against the attached video, not against my opinion of the war. "Faithful" means it matches the clip; "invented" means it appears nowhere in it. The account supplied the evidence that convicts the post.
▲ The correction never catches up
The Israeli account that flagged the Netanyahu-Spain mismatch has about 1,000 followers and drew roughly 6,100 views against the fabrication's 4.3 million, a reach gap of around 700 to 1. Every manufactured claim enjoys this structural advantage: it is built to be shared, the correction is not, and by the time anyone checks the clip the post has already traveled the network.
§ 11 · The Playbook, Seen Before
I have watched this exact play run before
In December 2025 I analyzed "Global Insight Journal," a different West Asia persona running the same misquoted-video play, and laid the case out in a public 16-page thread in March 2026. The fingerprints line up almost feature for feature.
Global Insight Journal (my prior analysis, Dec 2025)
- Generic press-brand persona, "West Asia" placement
- Created Sep 2025; username changed within weeks; verified later
- Load-bearing post: a video with words not said in the video
- Reshared Iranian, Russian, and Turkish state media dozens of times a day
- Amplified in staged phases: Turkish seeding, then Iranian, then Russian, inside one afternoon
- Output collapsed to near zero the night Iran's state broadcaster (IRIB) was hit, then rebuilt
The 16-page @talk2trav thread on the case, posted March 2026 · 624K views · view on X ↗
This network (this report, Jul 2026)
- 21+ generic press-brand personas, overwhelmingly "West Asia"
- Batch-created in 2026; repeated username changes; purchased verification
- Load-bearing posts: videos with words not said in the video
- Amplifies "IRGC"-branded personas and Iranian state media; carries pro-Russia content
- Event-driven bursts riding the "Iran war" news cycle
- Operators undisclosed; claims uncited
★ Why the precedent matters
One account behaving this way is an oddity. A whole network of them, eight months after a near-identical single-persona case, running the same misquoted-video play from the same region under the same disposable press branding, is a repeatable, scaling playbook. I label the pattern, not the sponsor: the earlier case surfaced timing evidence pointing at state broadcast infrastructure; this one adds scale.
§ 12 · Who Is Likely Directing This
Aligned with a state, attributed at high confidence
The alignment is unambiguous and it points one direction. The chain of control is not proven, so I present it as a graded assessment, not a verdict. Two different questions get two different grades here: whose interests the network serves is assessed at high confidence; who operates it is the open question the hypotheses below rank.
Competing hypotheses, ranked by fit
Indicators pointing to Iran-alignment
◆ The honest ceiling
"Iran-aligned" describes the content and the branding, which are unambiguous across the network. It does not prove that any Iranian state body registers, funds, or directs these accounts. I do not name a person and I do not name a government agency as the operator. Public data supports a coordinated-network finding and an alignment finding; only a legal order compelling the platform's registration, billing and device records can establish control.
§ 13 · What I Do & Don't Claim
The evidentiary line
The network is real and coordinated; the sponsorship is aligned but unproven. I keep those apart.
What I can show
- 21+ personas sharing one fingerprint, mutually following and amplifying each other.
- A near-verbatim bio clone (@GBX_Press) and same-minute batch creation.
- Fabricated quotes contradicted by the accounts' own attached videos.
- A disciplined pro-Iran, anti-US, anti-Israel line, with pro-Russia content, and West-Asia placement across the network.
What I do NOT claim
- That every account here is operated by the same single hand.
- That the genuine state outlets or officials the network follows are covert members.
- That the ordinary audiences resharing this content are bots.
- A named person, agency, or proven chain of state control.
§ 14 · Conclusion
The takeaway
A single fabricated post was the thread. Pulling it uncovered a coordinated Iran-aligned influence network of at least twenty-one manufactured personas on X: matched fingerprints, batch creation, a near-verbatim bio clone, interlocking follows, and one disciplined anti-Western, pro-Iran line carried to a combined audience in the hundreds of thousands, with individual posts in the millions. The proof that these accounts fabricate is not partisan and needs no outside source: it is contradicted by the videos they themselves attach. I do not name a sponsor and I do not call the audiences bots. I map the network, tier the evidence, and leave the final attribution to the legal process that could actually close it.
If you want the network resolved to operators, the next step is a legal order compelling the platform's registration, billing and device records for these accounts. That is outside what public data can prove and inside what a subpoena can.
★ Reach out, I read everything
I am Travis Hawley. If you spot a claim that looks manufactured, or you want a network traced, find me at shadowgraphintel.com/contact, @talk2trav on X, and @talk2trav on Instagram. And scrutinize whatever you read next, including me.
§ 15 · Scope, Method & Caveats
How this was done, and where I stopped
The disciplined version of everything above, for the reader who wants to stress-test it.
◆ Note on scope
This is an evidence-led account of a coordinated influence network and how I found it, not a verdict on the underlying conflict. I grade every claim by strength: what is directly verified (shared follows, a near-verbatim bio clone, same-day batch creation, fabrications contradicted by the accounts' own attached video) is kept apart from what is strong-but-inferential (that the wider persona family is one operation). I separate the covert persona accounts from the genuine Iranian state outlets they amplify, which are targets, not members. I make no allegation that the ordinary audiences resharing this content are bots. I describe the network as Iran-aligned in its content and branding; I do not name a person or prove a chain of state control, which only a legal order for platform records could establish.
◆ Method
The network roster was built by reverse-enumerating the three anchor accounts' follow graphs and hydrating each candidate's public "About this account" metadata (creation date, placement, verification, username-change count) through commercial social-media monitoring. Content findings rest on the most recent posts reviewed per account and on a fuller content export for the anchor. The fabrication findings were graded against the accounts' own attached videos, which are the primary source and require no outside material.
◆ Limitations: the tip of the iceberg
Every figure here is a floor, not a census. The roster of 21 is what surfaced from three accounts' follow graphs; a full-population enumeration would extend it. In-app video plays, quote-tweets, and screenshots reshared to other platforms are under-counted, and keyword-in-caption capture misses words spoken inside videos. Follower and view counts are platform-reported and should be re-verified at publication. Placement ("West Asia") is platform-derived from access patterns and is a flag, not proof of location or sponsor.
★ Standard disclaimer
Evidence-based assessment of publicly observable data, correlations and patterns. Certain claims remain unverified and this is not a determination of wrongdoing. Companion attribution assessment: SGI-2026-ATT-003.