New platform transparency data has provided clear proof that a cluster of prominent Scottish independence accounts on X, several of which briefly promoted pro-Iran themes during the June blackout, were being operated from inside Iran while posing as Scottish activists.
The findings reinforce the UK Defence Journal’s earlier reporting. UKDJ had been tracking a small sample of accounts tied to this wider cluster for several months, and the latest update from X now confirms what the behavioural evidence had long suggested.
The initial UKDJ investigation focused on a handful of accounts that appeared at first glance to be ordinary pro-independence users. They used Scottish images, familiar language and local references, but their technical footprints raised questions. The accounts often showed links to Iranian propaganda points, and all of those under close observation fell silent at the exact moment Iran suffered a nationwide blackout in June.
At that stage, the pattern was compelling but relied on inference. Analysts had no visibility of the internal account metadata that would prove where the operators were based.
The new transparency feature introduced by X however has changed that as the platform now displays limited account origin information, including the app store linked to the device used to access the service.
For the cluster UKDJ we followed, the transparency panels list the accounts as connected via the Iranian App Store and simultaneously routing through VPN servers in the Netherlands. This signature appears across all of the same users who went offline during the blackout and across several associated accounts that match the same behavioural pattern.
And it’s all of the ones we suspected. pic.twitter.com/UYMCRzuipt
— UK Defence Journal (@UKDefJournal) November 23, 2025
The link between the Iranian App Store and Dutch VPN points provides the proof that was previously unavailable.
Their creation details follow the same formula, each with a single username change completed at registration. Their posting rhythms track one another closely, with content appearing at regimented intervals that do not resemble the varied habits of genuine Scottish users. Their identities display the familiar signs of fabrication, including profile images with AI-style artefacts and bios that present Scottish personas with no traceable presence outside X.
The behaviour during Iran’s June blackout remains the clearest operational indicator. Every account in our tracked sample stopped posting at the same moment Iranian connectivity collapsed. None returned until the blackout ended. Several resumed activity with short bursts of pro-Iran or anti-Western messages before shifting back to independence content. With the new transparency data confirming the operators’ connection to the Iranian App Store, that sequence is now understood as a direct consequence of the outage rather than an unexplained coincidence.
Counter Terror highlights rising state threats, disinfo push
The accounts amplify each other’s posts within seconds, recycle the same slogans and work in near synchrony. This creates the impression of a vibrant and diverse group of Scottish independence supporters when the activity is in fact driven by a foreign influence operation. The new origin data confirms the underlying source of this activity and removes any remaining ambiguity.
On this revelation, Graeme Downie MP told me:
“This confirms what we already knew that Iran, as well as countries such as Russia and our other enemies, are actively seeking to subvert our democracy and discourse in Scotland and the UK. We are already in a grey war with our enemies and this is further proof of that.
While pursuit of Scottish independence is a valid political objective, this report shows the extent to which the debate is being influenced by unfriendly countries, some of which has been shared by elected SNP politicians who are unwittingly helping Scotland’s enemies. The SNP must be much more alive to this threat and deal with misinformation, including that shared by their own elected officials, much more robustly.”
The findings do not call into question the authenticity of Scotland’s independence movement. Genuine supporters continue to advocate for their views openly and transparently. The issue raised by this evidence is the presence of synthetic Scottish personas, run from outside the United Kingdom, inserting themselves into a debate that belongs to the people of Scotland.
Such activity distorts the perceived scale and tone of public opinion and misleads users about who they are engaging with online. Iranian information operations have targeted divisive political issues across Western democracies, and the Scottish constitutional debate has proven a suitable channel.
The latest update from X provides the clearest confirmation to date. The small sample tracked by UKDJ is now proven to have been part of an Iranian-run network, and its presence within Scotland’s digital political space remains a matter of concern for the integrity of online debate in the United Kingdom.












I wonder If It’s Iran that keeps taking this and other sites down 🤔🫡
Error 502 Bad Gateway,
Cloudflare outage.
I’m no Cyber Expert but It does seem that Internet Security isn’t all that great.
Aren’t you?
No George I’m not, I come here to read the excellent articles and join in the comments and It seems there are problems with Internet Security.
Cloudflare outages have affected this and many sites recently and I’m saying that these Internet Security Providers don’t seem to be that great.
That’s not You I’m referring to George, It’s internet Security from the providers that say they protect these places.
Other news just in, the Pope is Catholic…