Which organizations or researchers conducted the analysis alleging foreign control of MAGA accounts?

1. Who first put the claims in public view: platform feature + user threads

The immediate source of the revelations was X’s own rollout of an “about this account” or country-of-origin transparency feature; users began posting threads calling out that accounts presenting as MAGA or right‑wing American influencers showed locations outside the U.S., and those threads were amplified by journalists ^{[1] [2] [5]}. Harry Sisson’s thread and other viral X posts were repeatedly cited by UPI, The Wrap and others as the connective tissue exposing individual accounts in places like Bangladesh, Nigeria, Macedonia, Russia and Eastern Europe ^{[1] [5] [2]}.

2. Who aggregated and reported the findings: journalists and OSINT actors

Mainstream outlets and digital-native publications compiled the user discoveries into articles: UPI summarized Sisson’s analysis and listed countries implicated, The Guardian and The Independent published package stories about numerous MAGA personalities appearing to be based abroad, and The Wrap and La Voce di New York reported on specific high‑follower accounts identified via the new tool ^{[1] [2] [3] [5] [4]}. News sites also referenced “OSINT” and independent X users — for example, OSINTdefender and other self-described open‑source investigators who posted collections of flagged accounts ^[6].

3. Nature of the evidence cited: platform metadata, not forensic attribution

Reports rely on metadata exposed by X — the stated country/region where an account is “based,” join dates, username changes and app‑download signals — and on visible account bios and behavior. Coverage highlights that the new feature “revealed” where accounts were based rather than providing deeper forensic attribution linking them to state actors or formal influence operations ^{[2] [1] [7]}. Available sources do not claim these reports are the result of a lab‑style technical attribution analysis; they are mostly surface‑level location flags and user aggregation ^{[1] [5]}.

4. Who has disputed or contextualized the claims

While many outlets and commentators framed the findings as “exposing” foreign operators, reporting also included caveats: X’s feature shows account‑stated or detected locations and can be influenced by VPNs, mislabelling, or users who openly identify as non‑US but post US‑focused content; some accounts posted pushback saying they always listed a foreign location in bio ^{[5] [6]}. Publications noted long‑standing concerns about foreign influence on X and referenced past investigations (e.g., Washington Post 2024 work cited by IBTimes) to provide context that foreign propaganda networks have been present on the platform historically ^[8].

5. What’s missing in current reporting: formal, centralized research and attribution

No source in the provided set points to a single academic center, nonprofit research group or government agency publishing a comprehensive, peer‑reviewed study that confirms systemic foreign control of MAGA accounts; instead, the narrative is built from X’s own disclosure plus journalist aggregation of viral X threads and OSINT posts ^{[1] [2] [5]}. Available sources do not mention such a consolidated institutional analysis confirming intent, command-and-control, or state sponsorship beyond the location labels (not found in current reporting).

6. Competing interpretations and potential agendas to note

Proponents of the “foreign‑run” framing view the X disclosure as vindication of long‑standing warnings about external influence; detractors warn the labels can be misleading, argue users can be ex‑pats, contractors, or innocuous foreign enthusiasts, and note possible weaponization of the feature by rival online factions to discredit domestic voices ^{[2] [6] [4]}. Media outlets emphasizing separation of fact vs. implication tended to cite X’s metadata while avoiding definitive statements about malicious intent ^{[1] [5]}.

7. Bottom line for readers seeking clarity

The allegation that many MAGA accounts are “foreign‑run” stems primarily from X’s location‑disclosure feature plus user and OSINT threads amplified by journalists — not from a unified, independent forensic study — and reporting so far documents location flags for many high‑reach accounts across several countries but stops short of proving coordinated foreign control or state direction based on the sources provided ^{[1] [2] [5]}. Readers should treat the metadata disclosures as a prompt for further investigation rather than conclusive evidence of organized foreign influence until more formal attribution work is published ^{[1] [8]}.