Fake Flags: the Facebook network rebranding itself as Australian, British, French and Canadian communities · Benjamin Strick
BS Benjamin StrickOpen-source investigations
Networks Investigation

Fake Flags: the Facebook network rebranding itself as Australian, British, French and Canadian communities

Published 10 August 2026 Read 22 min Entities 46 core assets
Screenshot showing Meta's page-manager location field, captured across the core set
Meta's page-manager location field, captured across the core set

Forty-two Facebook pages and four groups present themselves as Australian, British, French, Canadian, Mexican and American local community outlets. They post emotive questions about immigration, religion and national identity, much of it over AI-generated imagery and videos, and some of that content is run through paid advertising for audience growth.

The pages are linked to Sri Lanka through Meta’s manager-location and advertising-disclaimer records. Between them they hold roughly 900,000 followers and members.

46
Core assets: 42 pages, four groups
~900,000
Follower and member positions
28
Core entities with rename histories
6
National identities adopted

Executive summary

What this is.

Research indicating a core network of 46 Facebook assets, made up of 42 pages and four groups, branded as Australian, British, French, Canadian, Mexican and American communities and managed from Sri Lanka.

The evidence comes from Meta.

Forty-one pages display Sri Lanka in Meta's page-manager location field. A forty-second, OzFacts, displays Sri Lanka in an advertising disclaimer. The four groups are administered by pages in that set.

Scale.

Approximately 808,000 page-follower positions and 94,100 group-member positions. Note that these are shared audience numbers across a network, not unique people. One account can follow several pages and join several groups.

Local identity is recycled, not founded.

Twenty-eight core entities carry rename histories. Ceylon Products became UK Pulse and then Canada Pulse. Nursing Life became British Life. Lanka Astrology became a French patriot page in five weeks.

The content is built for reaction.

Emotive propositions about immigration, religion, national identity and party politics, frequently over AI-generated imagery, presented as yes or no reaction prompts.

Growth was bought.

Ads carrying political and social-issue content were targeted at Australian and UK audiences with page likes as the objective, and payers were disclosed as being located in Sri Lanka.

Why it matters.

These assets present as local community outlets while Meta's own records place their management offshore, manufacturing the appearance of grassroots local opinion.

Policy.

The activity engages Meta rules on authenticity, inauthentic behaviour and foreign interference, authentic identity representation, and transparency for ads about social issues, elections and politics.

Recommended action.

Meta should conduct a network-level review rather than assessing pages individually, confirm whether the advertising was authorised in the countries where it was delivered, and restrict or remove assets where violations are established.

The Network & Evidence in a Snapshot

Life of Australia shows the pattern in miniature. It began as Thomas shelby, a reference to the Peaky Blinders TV show, then became Motivate My Life, returned to its original identity, then became MindNug before adopting its current Australian branding.

Life of Australia — recorded name history
01
Thomas shelby
→
02
Motivate My Life
→
03
Thomas shelby
→
04
MindNug
→
05
Life of Australia
Image showing Life of Australia, and its recorded name history (1 of 2)
Image showing Life of Australia, and its recorded name history (2 of 2)
Life of Australia, and its recorded name history

Life of Australia is one of three pages administering the Facebook group Australia Life. The same administrator set also appears in the related Aussie Life group. Note that another page, acting as a moderator, is also using the ‘Shelby’ name and is present in the admins and moderators panel of the two groups (see figures below).

Screenshot showing The same administrator set across both groups (1 of 2)
Screenshot showing The same administrator set across both groups (2 of 2)
The same administrator set across both groups

Meta’s Page Transparency panel displays one manager in Australia and one in Sri Lanka. Two other pages administering the groups also display managers in Sri Lanka.

None of that is hidden. Facebook publishes the Page history, manager countries and group-administrator list in its transparency and admin panels.

The entire investigation reviewed more than 350 captures collected between late July and early August 2026. The same pattern appears across pages and groups branded as Australian, British, French, Canadian, Mexican and American communities.

The public evidence supports a defined 46-entity core, while leaving broader ownership and coordination questions for Meta to test with internal data.

Evidence summary

The core set contains 42 pages and four groups connected through captured Meta records.

Forty-one of those pages displayed Sri Lanka in Meta’s Page-manager location field.

A forty-second, OzFacts (created in November 2023 under the name Brianna Dy), displayed Sri Lanka as the disclaimer location on its advertising.

Image showing OzFacts, disclosed through advertising rather than the manager field (1 of 3)
Image showing OzFacts, disclosed through advertising rather than the manager field (2 of 3)
Image showing OzFacts, disclosed through advertising rather than the manager field (3 of 3)
OzFacts, disclosed through advertising rather than the manager field

Four groups are administered by pages in the core set. Together, the pages and groups account for more than 808,000 follower positions and more than 94,100 member positions.

Network diagram showing Pages (blue circles) and Groups (green squares) network visualisation
Pages (blue circles) and Groups (green squares) network visualisation

Life of Australia and Aussie Unfiltered were created seven days apart and both used the name Motivate My Life.

Image showing Seven days apart, and the same former name (1 of 2)
Image showing Seven days apart, and the same former name (2 of 2)
Seven days apart, and the same former name

Both are categorised as ‘Digital Creators’ and display the same manager signature: Australia (1) and Sri Lanka (1). The overlap warrants investigation but does not establish a shared operator.

The group British Lover lists British Life, UK Talks, Life in USA and AeroLens among its administrators. All four display Sri Lankan managers. Four personal profiles are redacted for privacy. Their names, images and account identifiers are retained in the evidence package.

Twenty-eight core entities show rename histories. Across the full inventory, 42 pages contain at least one page rename, including shifts between unrelated commercial, personal and national identities.

Image showing Renames across unrelated commercial, personal and national identities (1 of 2)
Image showing Renames across unrelated commercial, personal and national identities (2 of 2)
Renames across unrelated commercial, personal and national identities

In terms of the content being posted, many pages used synthetic-looking or AI-labelled images and videos to frame emotive questions about identity, politics and culture. Almost always, a post would frame a question, and the graphic would have the question in it, with a reaction marker, (ie thumbs up for ‘yes’ and tear emoji for ‘no’).

Network diagram showing The question, the graphic, and the reaction marker (1 of 2)
Network diagram showing The question, the graphic, and the reaction marker (2 of 2)
The question, the graphic, and the reaction marker

The group previously analysed, Australia Life, with more than 26,000 members, repeatedly placed divisive propositions over national symbols, political figures or emotive images and invited users to react.

One sampled post asking whether Australia should outlaw child marriage and Sharia law received more than 7,500 likes and 1,400 comments. The accounts reposting the same image displayed Indonesian location indicators in public photos, language or work details.

Screenshot showing Repeat posts
Repeat posts
Method, scope and exclusionsExpand

The initial seed list was built after first discovery of the accounts using keywords and organic browsing. After identifying several patterns in the pages and groups (ie Australia in the title, the flag, over-the-top graphics in the banners and emotionally-response invoking posts), a seed list was built to commence a systematic capture of all related entities and attribution indicators.

Screenshot showing Screenshot of working dataset
Screenshot of working dataset

The total dataset built consisted of 97 flagged Facebook entities. They were flagged as suspicious based on the prior criteria mentioned of displaying pattern-like behaviour in posts and creation of accounts.

All collection was read-only. No posts, comments, reactions, follows or messages were made, and no private groups or messages were accessed. A logged-in browser session was used only to view material already public.

To ensure a systematic capture, I built a plugin for the browser where when I identified a suspicious page, group or any relevant details around page transparency, ad library, I would manually collect a full visual capture of the page and archive it to a self-hosted file, corresponding with an evidential package number.

Inclusion in the dataset does not mean inclusion in the core findings of this report; many were retained as leads, lookalikes or exclusions. Considering this, the entities were separated into four different buckets, or ‘tiers’.

Tier
Basis
Entities
Follower positions
Member positions
1. Core
Sri Lanka in the captured manager field or ad disclaimer, or a group administered by such a Page
46
808,000
94,100
2. Lead
Sri Lanka in a researcher note only, no captured manager field
7
16,000
29,500
3. Separate operation
Manager field captured, no Sri Lanka
12
1,703,800
0
4. Unresolved
No manager field captured
32
43,711
38,115

Only Tier 1 supports the core finding of this research. The remaining tiers are shown to make the exclusions explicit.

Tier 3 comprises 12 pages with no captured Sri Lanka manager signal and 1,703,800 follower positions. Captured locations across this separate tier include Bangladesh, Pakistan, Morocco, Vietnam and India. These pages are excluded from the core findings as they represent different markers.

01Case study 1: The Australian administrator network

Meta’s Page Transparency records show how the page ‘Life of Australia’ connects its rebranding history to the administrator network.

Network diagram showing Australia Life ownership network
Australia Life ownership network

The panel also records the page category as Digital Creator, and the manager locations as Australia (1) and Sri Lanka (1).

Screenshot showing Manager locations, and the page history (1 of 2)
Screenshot showing Manager locations, and the page history (2 of 2)
Manager locations, and the page history

A page that spent five years as a Peaky Blinders reference and a motivational brand became an Australian community identity in November 2025. Within eight months it had 42,778 displayed followers and was administering a group of more than 26,000 members devoted to Australian politics. The group was also highly active, with more than 400 posts observed on one day.

Screenshot showing Group statistics for Australia Life
Group statistics for Australia Life

Two of its fellow administrators tell similar stories. Everyday Australia was created in November 2025 and shows the same manager split, one in Australia and one in Sri Lanka. Aussie Bulletin shows one manager in Sri Lanka and was called British Voice until June 2026. Before it was an Australian bulletin, it was a British voice.

Image showing Everyday Australia, and Aussie Bulletin (1 of 2)
Image showing Everyday Australia, and Aussie Bulletin (2 of 2)
Everyday Australia, and Aussie Bulletin

Life of Australia and Everyday Australia display the same public contact address (australiaeverydaylife@gmail.com).

A reused email is more probative than visual similarity because it is shared operational infrastructure. Combined with joint administration of the same group and matching manager disclosures, it is consistent with coordinated administration.

Image showing Observed relationships, not ownership claims
Observed relationships, not ownership claims

While a name change is interesting, on its own it is not evidence of wrongdoing. Pages rebrand, get sold, and convert to new audiences for entirely legitimate reasons. What the history establishes is narrower and still significant: the apparent local identity of this page is eight months old, and the audience underneath it was assembled under four previous names.

02Case study 2: Two pages, one reused name

The Thomas Shelby history in the Life of Australia Facebook page contains an interesting lead. Between June 2020 and September 2022 the Page was called Motivate My Life.

A second Page in the same inventory carries the same name in its own history.

Screenshot showing Page ownership details (1 of 2)
Screenshot showing Page ownership details (2 of 2)
Page ownership details

Aussie Unfiltered was created on 5 July 2020, seven days after Thomas shelby, under a personal name.

The two accounts share very similar attributes:

  • creation seven days apart
  • the same Motivate My Life name
  • the Digital creator category
  • and the same manager signature: Australia (1) and Sri Lanka (1).

While this pattern is highly indicative of shared operation of the pages, it is not enough to take that leap, and only someone with access to platform-level data would be able to make that assessment.

03Case study 3: British Lover’s cross-border administrators

British Lover is a public Facebook group with 15,616 members. Its branding is British. Its administrator panel is not. It has a legacy name as well. When it was registered in May 2025, it was called “British Blood”.

The panel lists 11 administrators and one moderator. Seven administrators are pages or page-style accounts: British Life, UK Talks, Kingdom Voice, British Lover, AeroLens, Life in USA and OD. Four are personal profiles. Note, I’ve redacted their identities, but kept the visual indications revealing their Sri Lankan locality, indicated through names, birth/living addresses and posts on those accounts.

Screenshot showing Eleven administrators and one moderator, personal profiles redacted
Eleven administrators and one moderator, personal profiles redacted

Five of the administrator pages carry captured manager disclosures:

  • British Life, approximately 20,000 followers, three managers in Sri Lanka. Created in October 2025 under the name Nursing Life, renamed British Life in December 2025.
  • Life in USA, four managers in Sri Lanka. Created in October 2025 under a Sinhala-language name, renamed Life IN USA in June 2026.
  • AeroLens, three managers in Sri Lanka. Created April 2026.
  • UK Talks, three managers in Sri Lanka. Created in December 2025 under the name Nurse Talks.
  • British Lover, which shows one manager in the UK and was created in May 2025 under the name British Blood.

While four administrator pages display Sri Lanka in Meta’s manager field, British Lover displays one manager in the UK. Analysing British Lover’s account, posts tagged to London contained flora and ambient sounds associated with Sri Lanka or South Asia, not the UK. Those observations are contextual and carry less weight than Meta’s disclosures but do indicate a potential mismatch in authenticity.

Screenshot showing Posts tagged to London (1 of 3)
Screenshot showing Posts tagged to London (2 of 3)
Screenshot showing Posts tagged to London (3 of 3)
Posts tagged to London

The page also used the same pattern of emotive political posts, several of which gained substantial engagement.

Screenshot showing Posts from British Lover (1 of 2)
Screenshot showing Posts from British Lover (2 of 2)
Posts from British Lover

The page and group both previously used the name “British Blood”. Both were created on 12 May, 2025.

Image showing The same former name, the same creation date (1 of 2)
Image showing The same former name, the same creation date (2 of 2)
The same former name, the same creation date

Four administrator pages display Sri Lanka in Meta’s manager field. British Lover itself displays a UK manager while having indications that it might be Sri Lanka-linked or from Sri Lanka. The redacted personal profiles were also associated with Sri Lanka.

This should be considered when viewing the pattern of other groups. For example, the Facebook group I Love Australia, which has 35,100 members, lists nine administrators including Life In Australia and Moments of Australia, both showing Sri Lankan managers. Aussie Life, 18,900 members, is administered by exactly the same three pages as Australia Life, plus the same Don Shelby moderator profile.

The administrator pattern matters because the groups present themselves as local national communities. In those cases, those groups presented themselves as local Australian identity-based community groups, but were administered from Sri Lanka and posted divisive or emotion-invoking content.

Content and engagement

Australia Life is one of the groups those pages administer and help populate.

Its cover image compresses a tourist brochure into one panorama: Uluru, the Sydney Opera House, kangaroos, koalas, surf and a flag. The image carries the hallmarks of generative imagery: the koala looks more like a bad-tempered lion, and one kangaroo has the face of a bear.

The group’s description is one line of “Welcome to Australia life”.

Image showing The cover image, and its artefacts
The cover image, and its artefacts

Facebook records its creation date as 31 January 2026. By 4 August 2026 it had more than 26,000 members.

A snapshot into the group from 4 August 2026 says that it had 11.8k new posts in the last month, 42.8k new comments, and 199.6k new reactions in the last month.

Many of the comments seen in the group’s discussion feed relied heavily on a recurring format: a divisive proposition over a national symbol, political figure or emotive image, asking the audience to pick a side with a reaction.

Captured posts covered party leadership, Islamophobia, face coverings, public toilets, Sharia law and immigration. Two displayed hundreds of reactions and comments at capture.

Screenshot showing Posts made in the group
Posts made in the group

Several comment threads beneath these prompts contained openly hostile and dehumanising material.

Some captured posts carried Meta’s AI information label while visually similar versions did not, this is even though a Gemini mark also appeared on some images.

Screenshot showing Inconsistent AI disclosure. Gemini AI-generated watermark seen in the bottom right of the image. The AI content label was only seen on the account on the left. (1 of 2)
Screenshot showing Inconsistent AI disclosure. Gemini AI-generated watermark seen in the bottom right of the image. The AI content label was only seen on the account on the left. (2 of 2)
Inconsistent AI disclosure. Gemini AI-generated watermark seen in the bottom right of the image. The AI content label was only seen on the account on the left.

The contributor and content layer

A selection of public profiles that had published posts into the group were analysed as a sample of the content and its authors.

Many of the Facebook accounts posting in the Australia Life Facebook Group displayed signs of being from Indonesia, either through their self-reported locations, photos, language or other identifiers. Several profiles displayed creator-economy features, including Subscribe buttons or subscriber hubs.

Image showing The contributor layer (1 of 2)
Image showing The contributor layer (2 of 2)
The contributor layer

Several pages posting in the group used Australian branding while displaying managers in Sri Lanka. Other similar pages displayed different locations, including India.

Screenshot showing Page transparency of pages making comments in Australia Life (1 of 2)
Screenshot showing Page transparency of pages making comments in Australia Life (2 of 2)
Page transparency of pages making comments in Australia Life

Posts used local Australian political subjects, including Sharia law, immigration, an Australian mining magnate and the Commonwealth Games.

Image showing The contributor layer (1 of 2)
Image showing The contributor layer (2 of 2)
The contributor layer

Rebranding and paid growth

Rebranding across national identities

Of the data collected, at least 42 pages contained at least one rename. Read together, they show that some pages were repeatedly repurposed across subjects and national identities. Examples of those are:

  • Canada Pulse was created in April 2022 as Ceylon Products. It became Ceylon Business, then two Sinhala-language names, then UK Pulse in November 2025, then Canada Pulse in April 2026. Three national markets in four years.
  • J'aime la France was created on 11 April 2026 as Lanka Astrology. It became a French patriot Page on 17 May 2026. Five weeks. It displays 18,000 followers and two managers in Sri Lanka.
  • Australia Debates, 28,000 followers and one manager in Sri Lanka, was created in April 2018 as Sri job service.
  • Australia Info live was SL Modeling, then Sinhala Cartoon, then Fitness Models, then SL Modeling again, before adopting Australian branding in June 2026. Two managers in Sri Lanka.
  • Life in USA, four managers in Sri Lanka, was created under a Sinhala-language name in October 2025.
  • Moments of Australia was Moments of Netherlands, then Moments of Brazil, before it was Australian. Two managers in Sri Lanka.
  • We Are British, 42,000 followers and two managers in Sri Lanka, was Fun Viral, then British Vibe.
  • We Love Australia, three managers in Sri Lanka, began as a Portuguese-language computer and phone shop.
  • I Love Australia was I Love Italy until November 2025.

Advertising and disclosure records

Meta's Ad Library provides a different category of evidence from Page Transparency.

Page Transparency reports where managers are located. Ad disclosures identify the advertiser and payer attached to a specific, dated transaction. Data from the network in this research showed at least 13 unique advertiser labels and 13 unique payer labels.

The posts that were advertised repeatedly used national flags, soldiers, landmarks and direct instructions to press the follow button. Many promoted page growth rather than an issue.

Image showing Flags, soldiers, landmarks, and a follow instruction (1 of 5)
Image showing Flags, soldiers, landmarks, and a follow instruction (2 of 5)
Image showing Flags, soldiers, landmarks, and a follow instruction (3 of 5)
Image showing Flags, soldiers, landmarks, and a follow instruction (4 of 5)
Image showing Flags, soldiers, landmarks, and a follow instruction (5 of 5)
Flags, soldiers, landmarks, and a follow instruction

A number of the advertiser details were also public, revealing either Sri Lankan localities or Sri Lankan individuals.

Screenshot showing Advertiser and payer labels disclosed in the Ad Library (1 of 3)
Screenshot showing Advertiser and payer labels disclosed in the Ad Library (2 of 3)
Screenshot showing Advertiser and payer labels disclosed in the Ad Library (3 of 3)
Advertiser and payer labels disclosed in the Ad Library

A named payer is a useful attribution lead because it ties a name to a transaction. It does not prove that the person owns the Page, made the creative or controls a wider network.

The nature of the ads were driven depending on what the post was that was being promoted. In most cases, it was to build the follower count of the page in the country being targeted, in other cases it tried the same through promoting political posts.

For example, in this ad from What’s Happening Oz, a post was promoted with the content of religion and law. The target audience was all Australian states. The action in the ad was to get likes of the page and grow its follower base.

Screenshot showing Political content, page likes as the objective
Political content, page likes as the objective

In comparison, two UK-focussed pages ran ads targeting the UK to grow their pages, one through a “press like page” action, the other with a political post also requesting a like of the page.

Screenshot showing Two UK-focussed pages buying growth (1 of 2)
Screenshot showing Two UK-focussed pages buying growth (2 of 2)
Two UK-focussed pages buying growth

Meta policy and requested action

Foreign management, rebranding and AI-generated content are not violations in themselves. The questions that matter are narrower: do the assets mislead users about who is behind them, do they build audiences deceptively, and were paid political messages disclosed as Meta requires.

Most of Meta's page and group rules relate back to its Community Standards, whose Authenticity principle states that Meta does not want "people using our services to misrepresent who they are or what they're doing".

The findings in this research raise questions under three areas of Meta policy.

Policy and rule

Pages, Groups and Events. Do not create pages, groups or events for purposes that violate the Community Standards, give them a violating name, or change the name in a manner that significantly alters its existing purpose.

Observed in this research

Pages and groups branded as Australian, British, French and Canadian communities are managed from Sri Lanka. At least 42 pages show a rename. Ceylon Products became UK Pulse, then Canada Pulse. Nursing Life became British Life. Lanka Astrology became a French patriot page in five weeks.

Policy and rule

Inauthentic behaviour. Prohibits inauthentic assets used to deceive Meta or users about the identity or origin of an audience or the entity they represent. Prohibits Foreign Interference, defined as coordinated inauthentic behaviour where the network operators are not located in the same country as the audience the operation targets.

Observed in this research

Pages present as local community outlets while Meta's own panels place their managers offshore. Meta’s records place managers of the relevant pages outside the countries being targeted. No evidence of state direction was found, and none is claimed. Whether fake accounts are central to the network is only answerable with platform data.

Policy and rule

Authentic identity representation. Covers repeated or significant changes to identity details, and misleading profile information such as bio details and profile location.

Observed in this research

Serial renames across unrelated national and commercial identities. National flags, place names and local symbolism used as branding by pages managed elsewhere. One page displays an Australian landline that is not a valid Australian number.

Conclusion

Forty-six Facebook assets, consisting of 42 pages and four groups, present themselves as Australian, British, French, Canadian, Mexican and American communities. Meta records show Sri Lanka in the manager field of 41 pages. A forty-second page, OzFacts, showed Sri Lanka in an advertising disclaimer.

Together, the Facebook pages and groups hold roughly 900,000 follower and member positions.

They are linked by four kinds of evidence:

  • administrator roles connecting pages to groups
  • shared public contact details
  • recurring manager-location disclosures
  • and page histories showing that assets were repurposed from unrelated identities.

Content similarity carries less weight. Flags and reaction polls are common, and do not prove common control on their own.

The most important finding is not the scale of the network. It is how recently many of these assets took on their current identities. They were built on audiences created under other names, in other languages and for other markets. Ceylon Products became UK Pulse, then Canada Pulse. Lanka Astrology became a French patriot page in five weeks. A Peaky Blinders fan page became Life of Australia and now administers a group with more than 26,000 members discussing Australian immigration policy.

The evidence does not show that one person or company controls all the pages and groups. It does not show that any state directed the activity, that contributors were paid or briefed, or that revenue was earned.

Those questions require login records, device and payment data, Business Manager structures and role-change logs. That information sits with Meta.

This research is not a final product of the network. It still needs a thorough look at from internally within Meta. But a page-by-page assessment may miss the wider pattern. The appropriate response is a network-level review of shared administrators, Business Manager structures, devices and payment methods, as well as any use of fake accounts.

Related writing

All writing →
Get methods like this once a monthOSINT Field Notes: tools, techniques and one case file. New editions are always free.
Subscribe →