Sign up here to receive Bellingcat’s biggest investigations by email as soon as they are published. Become a member and support our work here.

In September, CBS News obtained new images of the aftermath of attacks on US bases in the Middle East from active service members. One told the news channel: “This is major damage to our bases that hasn’t been communicated to the American public. “We’re standing there with our eyes closed getting punched in the face,” they added.

While reports have detailed how Iran used Russian intelligence, including satellite imagery, to identify US troops, ships and aircraft, Bellingcat found that publicly available mapping platforms also reveal detailed and potentially sensitive information about US military bases in the Middle East. 

Google Maps and other online mapping services contain dozens of labels identifying facilities including headquarters, accommodation, gyms and fuel points. Publicly available photographs and videos, including material published by the US military, provide further details about how these facilities are used.

Experts told Bellingcat that such information could have helped inform Iranian targeting decisions by revealing where personnel gather and how bases operate. However, they cautioned that Iran would also have had access to other sources of intelligence. Reporting from Reuters earlier this year also highlighted how US officials believed commercially available location data was being used to target US troops in war zones.

The bases examined by Bellingcat are not secret and have operated for years in a region where US forces maintained a strong sense of security. Joseph Jarnecki, a research fellow at the Royal United Services Institute, said the US had been able to maintain aerial superiority and was understood to have significant air defence capabilities, but that Iran’s missile and drone campaign has undermined both assumptions. 

Iranian strikes have damaged at least 20 US military sites across Qatar, Bahrain, the United Arab Emirates (UAE), Jordan, Kuwait, Iraq and Saudi Arabia since the conflict began in February this year.

Governments can request that Google blur or remove sensitive information from its services and Google publishes data on government requests for content removal.

Bellingcat contacted the US Department of Defense who asked us to reach out to CENTCOM about the details in this story. We also contacted Google. However, we did not receive responses to questions from these respondents before publication.

We examined four of the largest and most heavily affected US military installations by Iran’s missile and drone campaign: Camp Buehring and Camp Arifjan in Kuwait, Muwaffaq Salti Air Base in Jordan and Al Udeid Air Base in Qatar. At each one, we found publicly available Google Maps information providing details about facilities inside the bases and how they are used.

Camp Buehring

At Camp Buehring in Kuwait, Google Maps identifies what is labelled as the main headquarters building, as well as a gym and a self-help facility, all of which were among locations destroyed by recent Iranian strikes. In addition to Google Maps place markers there are dozens of reviews and user-uploaded photographs.

Bellingcat verified that this was a headquarters building by matching the flagpoles and layout in a photo published by the US military’s Defense Visual Information Distribution Service (DVIDS) showing soldiers posing in front of the  building to the Google Maps satellite image.

We also identified details about one of the camp’s gyms, including the building’s layout and roof structure, as well as Google reviews that indicate when it is busiest.

Among the images published by CBS News in September was that of a heavily damaged tent-like structure with smoke rising from it. Bellingcat matched the location of this image to the above satellite imagery, verifying that it shows the gym building pinned on Google Maps.

Exclusive images released showing damage to E-3 Sentry AWACS aircraft at Prince Sultan Air Base in Saudi Arabia, plus damage to US military camps Arifjan and Buehring in Kuwait from Iranian strikes. Images sent to CBS by active US military personnel. (IRIB News) https://t.co/1urA44f4xz

— Middle East Observer (@ME_Observer_) September 15, 2026

A building labeled on Google as “DPW Self-Help Center” was also destroyed at Camp Buehring. Its Google Maps listing includes opening hours, and a photo posted by a Master Sergeant in 2017 labeled “My office in Kuwait” shows the interior of an office. Some of the notices on the walls inside the office are legible, including what appears to be a floor plan.

A Google Maps placemark labelled “Transient Tent” identifies a large accommodation area, while another review includes a ground-level photograph of one of the tents. The dining facility can also be seen from the inside, including information regarding meal times.

William Goodhind of Contested Ground, a visual forensics consultancy that uses OSINT and satellite imagery to analyse military sites, said the information available on Google Maps could reveal “the camp’s layout, the division between secure and non-secure areas, confirms likely accommodation areas, and shows day/time periods of low and high activity.”

Camp Arifjan

A satellite image of Kuwait’s Camp Arifjan, captured by Planet on March 4, 2026 and published by the The Washington Post, shows damage to numerous structures at the base. Bellingcat compared the image with publicly available mapping data to identify two damaged facilities.

View this post on Instagram

A post shared by Media Trending (@tmctrending)

A Google Maps listing for a lodging facility labelled “TPE FOR ARIFJAN” includes a soldier’s review discussing room reservations, accommodation shortages and cleaning schedules, indicating that the building was used for military housing. Although Google’s satellite imagery of the base is blurred, the facility is visible in unblurred Bing Maps imagery using coordinates obtained from its Google Maps listing. The satellite image published by The Washington Post shows heavy damage to the facility.

A “24hr Fuel Point” tagged on Google Maps is also blurred, but when the coordinates are copied and pasted into Bing Maps a clear satellite image of the fuel station appears. This facility is also seen destroyed on the satellite imagery published by The Washington Post.

Bellingcat contacted Microsoft to ask why the facility was not blurred out in the Bing Maps service. A spokesperson said: “When an entity requests removal from visibility on Bing Maps, we work through our process and act accordingly.”

Muwaffaq Salti Air Base

Three US service members were killed in Iranian ballistic missile strikes on Muwaffaq Salti Air Base in Jordan on July 17, 2026. The strikes appear to have caused extensive damage to a barracks in the north of the base, with satellite imagery released by Iran showing at least 20 structures destroyed.

Less than 40 metres from the nearest destroyed structure, and within the same living quarters area, Google Maps reveals the location of an “Airman’s Attic”. These are volunteer-run thrift shops for US Air Force personnel. 

A five-star review posted last year by a soldier includes a ground-level image of the facility, showing uniform drop-off points and fortifications along the perimeter. The listing provides information about the area’s use, while photographs of the shop’s exterior make it possible to match the satellite imagery to the location on the ground.

A Sky News investigation also found that 80 percent of the runs shared publicly on the sporting app Strava at Muwaffaq Salti Air Base during the April ceasefire started or finished in this northern barracks.

Less than 100 meters from the destroyed area, “LSA DFAC” is pinned on Google maps. “DFAC” is the standard US military acronym for “dining facility”, according to Stars and Stripes. Several Google reviews also discuss the steak being served in this location.

Al Udeid Air Base

Similar mapping information is available for Al Udeid Air Base in Qatar, the largest US military installation in the Middle East. 

The base appears unblurred on Google Maps and entries on the platform identify the functions of numerous buildings. These include lodging facilities, which videos and reviews indicate are used by US Air Force crews and show the interior layout of the facility.

Meanwhile, Russia’s Yandex Maps details the site of two cinemas, a bar and a school on the base. This appears to match information provided on Google Maps.

While Al Udeid Air Base was damaged during Iranian attacks earlier this year, the areas that were struck do not appear to be among those listed on Google. 

Business Insider reported that a geodesic dome that housed secure communications equipment was hit in the strikes. ABC News detailed how another building had been damaged near the centre of the base. Google Maps shows a large warehouse-like structure at the location where ABC News reported this strike.

A New Reality in the Middle East

Former US Air Force targeting specialist Wes J. Bryant said the problem facing US bases in the Middle East reflected a broader assumption within the military that bases in allied countries were safe from serious attack. He said the belief that these were rear-area bases where “nothing’s going to happen out here” was a fundamental miscalculation, and that the Google Maps issue was an example of the military failing to account for that vulnerability.

Matthew Savill, Director of Military Sciences at the Royal United Services Institute, said Western militaries do not have consistent policies governing what information can be publicly posted about sensitive sites. He said the issue needs to be considered before a conflict begins, rather than when attacks are already underway. “The start point should be, can we enforce operational security discipline?” Savill pointed to restrictions already in place at some UK military facilities, including Faslane, a naval base that houses the UK’s nuclear submarines, where he said personnel are not permitted to use mobile phones on site.

Savill told Bellingcat that the different pieces of data available on Google Maps, even if outdated, provided a “pattern of life” about US bases in the Middle East. But he added that the use of Google to help with the military targeting of Western bases is not new, saying he encountered the issue while deployed to Iraq more than 20 years ago.

“When I was in Iraq, we knew for a fact that insurgents and militants had been using commercial imagery, including Google Earth, to try and map our bases,” he said. “We have known for more than 20 years that there is a vulnerability that if you don’t stop the collection and layering of data early on, that your bases can be heavily mapped.” 

The use of open-source information to support military targeting has been documented in Ukraine. In 2022, Foreign Policy detailed how Ukrainian private intelligence company Molfar used photographs of Russian soldiers published by Russian media alongside Google Earth satellite imagery to identify their location. Molfar passed its findings to Ukrainian intelligence, and the site was subsequently struck by the Ukrainian military.

The security risks of publicly mapping military installations were recognised by the US military in 2008, when the Pentagon banned Google’s Street View from documenting the interiors of its bases. Since the Iran war started, US military commanders have also warned service members about posting photographs and videos from bases after Iranian attacks, cautioning that such footage could help Iran assess the effects of its strikes.

Iranian attacks have forced US personnel to evacuate many additional locations that were deemed too vulnerable to further strikes. 

In total, 23 US service members have been killed and 865 wounded in the US-Iran war, according to the Pentagon.

Bellingcat’s Jake Godin, Charlotte Maher and Merel Zoet contributed to this report.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

The post How Online Maps Lay Bare the US Military Bases Targeted by Iran appeared first on bellingcat.

Sign up here to receive Bellingcat’s biggest investigations by email as soon as they are published. Become a member and support our work here.

Imagery captured by the European Space Agency’s freely available Sentinel-2 and Sentinel-1 satellites appears to be delayed over Gaza and parts of the West Bank, a Bellingcat analysis has found.

While the delay remains relatively short at just 24 hours, this can still impact the speed at which analysts and researchers can observe what is happening in the region.

For example, the Israeli Defence Forces demolished homes in the West Bank Palestinian city of Hebron in recent days. New imagery captured on October 26, which included Hebron, would allow open source researchers to quickly confirm the demolitions, assess the impacted area and observe any unreported IDF activity. But imagery for the western half of Hebron was not available until October 27 due to the Sentinel-2 delay, inhibiting real-time fact-checking and reporting on this evolving situation.

A spokesperson for the European Union told Bellingcat that the delay was not related to events in Gaza but to “mitigate possible threats” due to the war in the Middle East “including Iran’s attacks on its neighbours and possible threats to European interests”. The delayed region of Sentinel tiles that cover Gaza as well as parts of Israel and the West Bank also extends over the Eastern Mediterranean Sea.

The European Union ordered a 24-hour delay on Sentinel satellite imagery over the Gulf of Oman earlier this year during US and Israeli strikes on Iran. However the delay impacting Gaza and parts of the West Bank has not been announced or previously reported.

“Such decisions are taken unanimously by all EU Member states and will stay in place as long as necessary,” the spokesperson said. They also said that while the Copernicus program, which includes the Sentinel satellites, operated a free and open data policy there were limitations to this for security. 

When asked if the delay, which began in late March, was related to the presence of US vessels in the Eastern Mediterranean or if there were other areas of delay, the spokesperson said they had no further comment.

Sentinel Delays

The Sentinel-2 and Sentinel-1 satellites provide an invaluable source of imagery for open source researchers. This has been especially true this year, as commercial satellite imagery providers restricted access to imagery in the Middle East, including areas of active human rights concern, such as Gaza. 

However, in July, the European Union published Council Decision 2026/1716, which ordered a 24-hour delay on Sentinel imagery over the Gulf of Oman, after a request from the US government which was involved in strikes on Iran at that time.

Just two weeks later, the European Union issued a corrigendum that unpublished decision 2026/1716 and removed it from the Council of the European Union record, although satellite data shows the delay has remained. 

This decision, while it was available, was reportedly the first public notification of delayed Sentinel imagery. Yet it was not the first time that Sentinel imagery has been restricted, analysis shows. Bellingcat found four distinct regions of delayed satellite imagery during 2025 and 2026: the Gulf of Oman, the Gulf of Aden/western Arabian Sea, the Red Sea as well as the previously unreported delay in the Eastern Mediterranean Sea and parts of Israel, the West Bank and the entirety of Gaza.

Bellingcat’s analysis shows that these delays have been implemented in stages. Twenty-four hour delays of Sentinel-2 imagery were first observed by open source researchers in March and April 2025 after the US launched a naval and air strike campaign against Houthi targets in Yemen. 

The previously unreported imagery delay in the Eastern Mediterranean began on March 28, 2026, the same month that commercial American space imaging company Planet Labs also restricted imagery across the Middle East. The Gulf of Oman delay began on July 15, 2026, two days after the publication of Council Decision 2026/1716.

Decision 2026/1716 also specified that the delay be implemented for both Sentinel-2 and Sentinel-1 radar imagery. Bellingcat’s analysis of Sentinel-1 image availability shows that this is the case for both the Gulf of Oman region and the unreported region over the Eastern Mediterranean Sea. However, the 2025 restrictions on Sentinel-2 imagery in the Red Sea and Gulf of Aden are not implemented in Sentinel-1. 

Sentinel-1 imagery uses “synthetic aperture radar” to capture lower resolution radar images that can collect data at night and on cloudy days. This differs from Sentinel-2, which captures optical satellite imagery at higher resolution.

A Tale of Two Tiles

Sentinel satellite imagery is most commonly accessed by open source researchers through Copernicus Browser, a free online platform, but it is also distributed as large tiled files in the Copernicus Data Space Ecosystem. These tiles are numbered using the Military Grid Reference System, and can be listed using APIs that provide information on each tile, including the capture and publication time. By comparing the capture and publication time, the publication delay can be computed.

For example, the catalog information for the tile T36RXV, which includes Gaza and portions of the West Bank, Negev and Egypt, provides the following metadata for the October 21, 2026 capture.

This shows that while the image was captured at 08:20 UTC on October 21, it was not published until 10:09 UTC on October 22 — almost 26 hours later. This is in contrast to the neighboring tile T36RYV, which includes parts of the West Bank, Israel, and Jordan. API data for this tile shows that the image was published at 12:10 UTC on October 21, just under four hours after the capture time.

This difference is not unique to this date either. Bellingcat’s analysis shows that this tile has been consistently delayed by one day since March 28, 2026.

This method can be extended further, and by analysing every tile with valid publication date timestamps, Bellingcat identified all global Sentinel-2 and Sentinel-1 delays since 2023. The only consistent delays visible were those identified in the Gulf of Oman, the Gulf of Aden/western Arabian Sea, the Red Sea and Eastern Mediterranean in 2025 and 2026.

Impact on open source investigations

While the 24-hour delay on certain Sentinel imagery is a less severe restriction than other satellite providers have imposed, it can still impact the open source research process in fast moving situations. This is especially so in recent months as the European Space Agency’s Sentinel satellite data has emerged as a refuge as other satellite data is censored.

The image below shows how imagery for the eastern half of Hebron was visible on October 26, but not the western half where demolitions took place earlier this week.

The shape of the missing tiles can be seen by zooming out within the Copernicus browser, demonstrating how imagery of Gaza and other parts of Israel and the West Bank are also delayed.

Sentinel imagery covering western Hebron after the demolitions took place was published on October 27. However, the delay prevented local reports from being verified with satellite imagery while the situation was still ongoing.

Some Sentinel-2 users have previously described the challenges of covering fast-moving issues in the Gulf of Oman when the Sentinel delay was announced in March.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

The post EU Satellite Imagery Delayed Over Gaza and Parts of West Bank by 24-hours appeared first on bellingcat.

Earlier this week, several viral social media posts and news articles stated that Google had updated satellite imagery over Gaza.

The imagery shared in these posts and articles shows several areas, including the southern city of Rafah. Huge destruction is detailed in the images, including what appears to be entire neighbourhoods flattened

But the imagery wasn’t entirely new. 

A Google spokesperson told Bellingcat that they regularly updated third-party satellite images and that the latest Gaza imagery had actually been available since June 2026. 

Tomorrow's front page

New satellite pictures lay bare Israel's destruction of Gaza pic.twitter.com/E65GXUHwrG

— The National (@ScotNational) September 28, 2026

Social media posts from earlier this year also detailed how Google Earth Pro users (a program that needs to be downloaded) had been analysing what appears to be the same imagery that was showcased this week by media outlets as early as May.

Google Earth has updated its satellite imagery to 2026 for the central and south Gaza strip.

In this thread, we will be going over some areas that I found interesting while I explored the update.

If you want a screenshot of a site, reply with the coordinates, and ill send. https://t.co/rPYzpKNRmW pic.twitter.com/iZpncz6bVH

— Stinky (@Stinky915846091) May 22, 2026

Bellingcat has access to satellite imagery from commercial space company Planet Labs, which shows further destruction in Rafah after the June Google update.

The Planet Labs imagery also gives insight into destruction further north in Gaza as recently as September.

Demolitions and Destruction Continue

The Google imagery updated in June showed a satellite image captured by the Airbus satellite imagery provider several months prior, in February 2026. 

When compared to a previous image of the same area that was published and visible on Google in June 2024, the difference is stark. Entire neighbourhoods have been razed while several school facilities near the Tal as Sultan area appear to be among the most prominent buildings still standing.

Satellite imagery shows visible changes across Rafah between June 2024 (left) and February 2026 (right). Image credit: Airbus via Google Earth.

Bellingcat previously reported on this destruction when it first started taking place in 2024. And the demolitions have continued since Google published its latest Airbus images in June.

The most recent high resolution imagery from Planet Labs, which uses its own constellation of satellites called SkySat, was taken in September. This was seven months after those now displayed on Google, and shows buildings near Rafah’s municipal stadium have now been demolished. 

A number of schools and other buildings near the Tal as Sultan area previously still standing to the northwest of the stadium are also now shown to have been demolished in the September imagery.

Satellite imagery shows visible changes across Rafah between February 2026 (left) and September 2026 (right). Image credit: Planet Labs PBC.

The centre of Bani Suheila, a town just to the east of Khan Yunis in southern Gaza, also looks drastically different from how it appears in the Google imagery. 

While most of the buildings surrounding the centre of the town are visibly damaged or destroyed in the Airbus imagery, updated imagery from Planet shows that even more of the buildings have been reduced to rubble, with an IDF outpost now visible on top. A large earthen barrier is also visible, cutting through the town from north to south.

Satellite imagery shows visible changes in town of Bani Suheila between February 2026 (left) and September 2026 (right). Image credit: Planet Labs PBC.

Recent Planet Labs imagery also shows the level of destruction in northern Gaza, primarily in the eastern areas of the towns of Shujaiya and Jabaliya.

Satellite imagery shows visible changes in town of Jabaliya between December 2024 (left) and September 2026 (right). Image credit: Planet Labs PBC.

Both Shujaiya and Jabaliya were already heavily damaged before the most recent ceasefire. Satellite imagery shows that the IDF has continued razing large parts of both neighbourhoods while building outposts.

Satellite imagery shows visible changes in town of Shejiya between December 2024 (left) and September 2026 (right). Image credit: Planet Labs PBC.

Earlier this week, reports also surfaced that an Israeli satellite imagery provider had released images over northern Gaza before they were taken down.

Satellite images such as these appear to show that Israel has not stopped reducing buildings in Gaza to rubble despite the continuation of an official ceasefire.

Israel previously told media that the mass demolitions were part of an effort to “demilitarise” Gaza. 

According to United Nations data, about 82 percent of the structures in Gaza are damaged, with two -thirds of them destroyed. 

With international journalists still widely unable to enter Gaza freely, satellite imagery remains one of the only ways to assess the true scale of destruction and to understand what is happening on the ground.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

The post Viral Google Maps Images Shared Widely This Week Show Gaza Ruins. We Obtained More Recent Satellite Imagery appeared first on bellingcat.

This article is the result of a collaboration with The Sunday Times. You can find their corresponding piece here. 

Sign up here to receive Bellingcat’s biggest investigations by email as soon as they are published.

Christy Kinahan, the Irish founder of the Kinahan Organised Crime Group who is being pursued by authorities around the world from his bolthole in the United Arab Emirates (UAE), has had his residence permit cancelled.

The visa was cancelled at the end of last month, just weeks after the extradition of his eldest son Daniel Kinahan from Dubai to Ireland, where he is charged with directing the activities of a criminal organisation.

Support Bellingcat

Your donations directly contribute to our ability to publish groundbreaking investigations and uncover wrongdoing around the world.

Donate

It follows a review of public immigration records by Bellingcat and The Sunday Times, published in August, which revealed that Christopher Kinahan Jr, another of Christy Kinahan’s sons, was recently issued with a new two-year visa in the UAE. 

This is despite his status as a sanctioned individual who, like his father and older brother, is the subject of a $5 million reward from the US government for information leading to his arrest or conviction.

Last month, we also exposed the residence statuses of the crime gang’s other sanctioned leaders who remain at large in Dubai. These include cartel lieutenant Bernard Clancy, whose residence permit was renewed in January, as well as padel poster boy Ian Dixon and Christy Kinahan, who have been living in Dubai on expired permits.

The cartel members had all obtained employment-based residence visas sponsored by Dubai companies, which are required to apply for employee work permits through the UAE’s Ministry of Human Resources and Emiratization.  

Christy Kinahan’s most recent visa listed his employer as OSA Management Consultancies DWC LLC, which is based at the same Dubai address as cartel-linked firm CV Aviation Consulting Services DWC LLC. The visa expired on April 1.

A new search of Emirate government portals shows the visa was subsequently cancelled on August 31. 

According to information published by a UAE government-authorized service provider, visa cancellation applies to people who leave the country permanently, alter their visa category or change employer. For employment-based residence visas, the cancellation process must be initiated by the employer or an authorised representative. 

Related articles by Bellingcat

Europe

Welcome to Dubai: Kinahan Cartel’s Visas Revealed

In the case of Kinahan’s visa, the specific reason for the cancellation is unknown. However, his last date for leaving the country is listed as September 29 in the government immigration file. This is in line with the 30-day grace period granted to holders of standard employment visas after cancellation.

The Sunday Times reports today that Europe’s intelligence services believe Kinahan is still in Dubai, though rumours that he has moved to Africa have sparked speculation he has already fled the Gulf. It also reports that the cartel leader has moved assets out of the Emirates as the crime group breaks into rival factions.  

The Kinahan Organised Crime Group is a $1.5 billion transnational network involved in drug trafficking, money laundering and arms smuggling. Investigators have connected it to Iran’s intelligence services and the Lebanon-based militant group Hezbollah.

The UAE foreign ministry has been contacted for comment.

Connor Plunkett, Peter Barth, Beau Donelly and John Mooney contributed to this article.  

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

The post Christy Kinahan’s UAE Residence Visa Cancelled appeared first on bellingcat.

This article is the result of a collaboration with The Sunday Times. You can find their corresponding piece here.

Every Friday evening, the brochure says, players can compete to win cash prizes in one of the world’s fastest-growing racquet sports. The padel club in Dubai’s west is the picture of modern wellness culture: climate-controlled courts, a private sauna and ice bath, and one-on-one coaching. The promotional image shows a bearded man in mid-swing, eyes locked on the ball. He wears matching activewear and a golden tan. The poster boy for padel is a talented player who once finished runner-up at an international tournament. He has also spent the past decade living in the shadows.

Support Bellingcat

Your donations directly contribute to our ability to publish groundbreaking investigations and uncover wrongdoing around the world.

Donate

Ian Thomas Dixon is a key figure in the Kinahan cartel, the Irish organised crime group that authorities say has evolved into a US$1.5 billion transnational network involved in drug trafficking, money laundering and arms smuggling. Investigators have connected the cartel to Iran’s intelligence services and the Lebanon-based militant group Hezbollah. Its feuds with rival gangs have been linked to at least 18 murders across four countries.

Dixon, 36, along with the Kinahan Organised Crime Group’s senior leadership – Christy Kinahan, 69, and his sons Daniel, 49, and Christopher Jr, 45 – was sanctioned by the US government in 2022. Authorities allege the Irishman acted as a trusted lieutenant to Daniel Kinahan, who is said to manage the cartel’s vast drug trafficking operation by helping move bulk cash across Europe, arranging payments and keeping tabs on money owed by a narco-trafficker.

Bellingcat and The Sunday Times can today reveal how Dixon’s racquet sport hobby has left behind a digital trail that led to the most recent footage of him since those sanctions were imposed – the first time he has been pictured publicly in almost a decade. This investigation also uncovers the alias Dixon has used in Dubai and exposes the first open source links to an underworld associate who was recently extradited from the Gulf state and jailed in Scotland.

It comes as cartel leader Daniel Kinahan awaits extradition to Ireland after his arrest in Dubai on foot of a warrant issued by Irish authorities. The arrest, in April, followed an extensive policing and diplomatic effort from international law enforcement.

In March, investigations by Bellingcat and The Sunday Times exposed the first photographs of Daniel Kinahan and his father in years and also revealed that the cartel’s “friend”, former UFC fighter Mounir Lazzez, was connected to US sanctions against Iran.

The latest findings give an unprecedented glimpse into the recent activity of a key cartel associate who, until now, has largely flown under the radar.

Family Ties

When cartel founder Christy Kinahan moved to Spain after his release from an Irish prison in 2001, it wasn’t long before his new home became a hub for the gang. His sons, Daniel and Christopher Jr, soon followed him to the Costa del Sol – as did their younger cousin, Dublin native Ian Dixon.

From the late 2000s onward, Dixon worked for businesses linked to the crime family in the south of Spain. One of these was The Auld Dubliner, a pub in Estepona that reportedly served as a base of operations for the cartel. In 2010, the pub was raided and temporarily closed by authorities as part of Operation Shovel, a years-long multi-national police investigation into the cartel’s drugs and arms-trafficking activities.

Dixon would also work as a trainer at MGM Marbella, the boxing gym co-founded by Daniel Kinahan that would go on to represent some of the biggest pro boxers in the world. The company, which was renamed MTK Global, shut down after the US sanctions on the Kinahans were imposed in April 2022.

In 2016, Dixon was arrested by Spanish police investigating the murder of Irish criminal Gary Hutch. The previous year, Hutch had been gunned down while out for a morning jog in a gated community on the Costa del Sol.

Dixon was released without charge, and another Kinahan cartel associate was later sentenced to 22 years for his role in the murder. The killing sparked a feud between the Kinahans and the rival Irish Hutch gang  that resulted in at least 18 deaths. 

Dixon and other key Kinahan members fled to Dubai in the wake of the deadly feud.

Ian Dixon has no known convictions. But his alleged role in the Kinahan Organised Crime Group was laid bare when the US sanctioned him. Authorities said Dixon managed finances and moved bulk currency for Daniel Kinahan and also kept tabs on the debt owed by a narco-trafficker. 

The sanctions notice also said Dixon controlled Hoopoe Sports LLC, a Dubai firm that listed a number of pro boxers among its clients and reportedly received more than $4 million for bouts involving former heavyweight champion Tyson Fury. Boxing promoter Bob Arum told Yahoo Sports the money was for consulting fees owed to Daniel Kinahan.

Dixon lived in an exclusive gated community in Dubai, according to the 2022 sanctions notice. Online listings show that properties like his Spanish-inspired villa are worth up to $2.7 million.

Passion for Padel

Padel is an increasingly popular racquet sport from Mexico best described as a combination of tennis and squash. According to the sport’s governing body, it has more than 17.5 million weekly players across 150 countries and the UAE, where Dixon lives, has the second-highest number of padel courts in Asia. It was on these courts in late 2024 that Dixon played in the master final of the Asia Pacific Padel Tour (APPT).

APPT rankings show Dixon registered for the tournament under the name “Ian Thomas”. Like his cartel leader relative Christy Kinahan, who used his first and middle names as an alias on his Google review profile, Dixon had dropped his surname.

Finding a Fugitive – How we Located Dixon

Bellingcat found the padel club promotion showing Ian Dixon after running images of the cartel associate through a publicly available facial recognition search engine. Among the results was a link to a graphic designer’s online portfolio, which included the advertisement for the padel competition. The original photo had been posted on the sports club’s Instagram page in late 2023, with the caption: “Elevating fun, one swing at a time!” Dixon was not named.

We searched for additional open source evidence and located online profiles for a 36-year-old Irish padel player named “Ian Thomas” who had taken part in a number of matches in Dubai in recent years. One profile shows he played 16 ranked matches between September 2024 and April 2026 – the most recent being the week after Daniel Kinahan’s arrest. But the accounts did not include profile pictures.

Bellingcat searched for footage showing the padel events and venues listed on the profiles. It returned multiple social media posts and live-streams clearly showing Ian Dixon at the same events where “Ian Thomas” was registered as playing. Dixon can also be heard speaking with a Dublin accent and at one point is seen with a close relative of Daniel Kinahan.

Dixon and his doubles partner played four games over the December 13-15 weekend, eventually placing second after losing in the final. The Irish cartel associate is captured on film after the match receiving a silver medal and commemorative racquet.

The Asia Pacific Padel Tour was held a month after senior Kinahan cartel figure Sean McGovern was arrested in Dubai on foot of an Interpol red notice. McGovern was extradited to Ireland last year and earlier this month jailed for 24 years for directing the activities of a criminal organisation in relation to murder and attempted murder. 

The tournament was live-streamed to YouTube via webcams set up on two courts. Dixon was captured throughout the three-day event, both playing on the court and mingling with others in the background. The hour-long male amateur final, which Dixon lost, is viewable in its entirety.

Dixon also posed for photos during the tournament, but it appears he did have some reticence about appearing on social media. In two images from a different padel event hosted at the same venue a few months later, Dixon’s face had been covered. However, a third photo was not edited, confirming that it was Ian Dixon.

Kingpin in the Crowd

Among the people Dixon was seen with at padel events in Dubai was Stephen Jamieson, a Scottish criminal who was recently jailed for his role in a multimillion-dollar drug trafficking operation.

Dixon greeted Jamieson with a fist pump during the Dubai APPT tournament in December 2024 on the day the Irishman played in the amateur final.

Dixon was also pictured with Jamieson at a family day padel event just weeks before the Scottish criminal’s arrest. (Bellingcat is not publishing details of that event to protect the identity of family members.)

Jamieson, who has multiple convictions, was extradited from Dubai last year and is serving a six-year prison sentence in Scotland on organised crime and drug charges. The case against him was built around intercepted messages he had sent via the defunct encrypted communication network EncroChat – a network the Kinahans have also used – to direct drug shipments.

The Sunday Times reports today on the Kinahan cartel’s deeply entrenched links to organised crime in the UK, where it is known to control much of the illicit drug market. It said the footage showing that Dixon and Jamieson know each other could indicate an underworld connection, since cartel cadres do not associate with rival operations.

Three of the seven alleged key Kinahan cartel figures have been arrested since the US sanctions were imposed. Johnny Morrissey, arrested in Spain in 2022, was later bailed and subject to a travel ban. Sean McGovern was jailed earlier this month and Daniel Kinahan awaits extradition to Ireland after his recent arrest in Dubai. Garda Commissioner Justin Kelly, of Ireland’s police force, recently said the investigation into the Kinahan cartel was ongoing and that authorities were continuing to focus on the other members of the gang.

Ian Dixon did not respond to questions from Bellingcat.

Connor Plunkett, Peter Barth, Beau Donelly and John Mooney contributed to this article. 

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

Support Bellingcat

Your donations directly contribute to our ability to publish groundbreaking investigations and uncover wrongdoing around the world.

Donate

The post Poster Boy: Sanctioned Kinahan Cartel Lieutenant Found Playing Padel in Dubai appeared first on bellingcat.

On February 15, 2026, the bulk carrier, Grumant (IMO: 9385879) was pictured at the occupied Ukrainian Port of Feodosia on the Crimean peninsula. Satellite imagery suggests it had already been there for several days.  It appeared to stock up on grain before departing on a two-month-long journey eventually docking at the Port of Benghazi in Libya on April 18.

While there have been previous reports of grain shipments from occupied Ukraine arriving in Libya, this is only the second time a Russian ship has been observed delivering what the Ukrainian government describes as “stolen” grain to the country. The previous case involved the Damas Wave which travelled in January of last year to the port of Misrata which is under the control of the UN-recognised Government of National Unity (GNU). In addition to satellite imagery, Bellingcat deployed a new technique that analysed Grumant’s heading data which was contained in AIS information provided by Lloyd’s List Intelligence, to help confirm Grumant’s presence in Feodosia. 

Bellingcat has been tracking smuggled Ukrainian grain shipments as they find new markets, five of the ships we previously identified have since been sanctioned by the EU while another was sanctioned by the US Department of Treasury.

MapLibre | Protomaps© OpenStreetMap contributors

Bosphorus Strait

Grumant transits the Bosphorus Strait in the middle of the night.

Credit: Yörük Işık.

Black Sea

Grumant enters a region of the Black Sea known for GNSS interference, meaning that Grumant’s publicly reported Automated Identification System (AIS) position is unreliable.

Port of Feodosia

On February 15, a high resolution satellite image confirms the ship is docked at the port of Feodosia at berth No. 1 that is used for bulk and metal cargo. Matching features visible include Grumant’s grey decking, its seven hatches and bright yellow front mast. What appears to be leftover grain can be seen under the two port crates, immediately next to the ship.

Credit: Satellite image ©2026 Vantor.

Black Sea

Grumant exits the area of signal interference, meaning that its reported position on ship tracking services is now reliable again. Its AIS messages indicate it is travelling towards the Bosphorus.

Bosphorus Strait

Grumant transits the Bosphorus Strait towards the Sea of Marmara. Judging by the draft, with no visible red paint on its hull, the ship appears to be fully laden.

Credit: Yörük Işık.

Izmir Anchorage

Grumant arrives in Izmir, Turkey on February 23 and anchors off the coast until March 13.

Over the course of three weeks, Grumant never enters the Port of Izmir. It is not known if it was denied entry. Bellingcat asked the port operators but did not receive a response before publication.

Credit: Planet Labs PBC.

Aliağa

Grumant then loiters off the coast of Aliağa, about 50 km from Izmir. It stays here until March 16, never entering the port. It again is not known if it was denied entry. Bellingcat asked the port operators but did not receive a response before publication.

Near Benghazi

Grumant arrives in Libyan waters and stays off the coast of Benghazi until April 1.

Libyan Waters

Grumant briefly leaves the coast of Benghazi, but returns a few days later.

Benghazi

Grumant leaves the anchorage on April 18 and docks at the port of Benghazi where it unloads the grain. The ship was captured in a Vantor satellite image on April 20.

It leaves port on April 23, and heads back towards the Bosphorus.

Credit: Satellite image ©2026 Vantor.

Bosphorus Strait

After spending a few days off the coast of Tuzla, Grumant transits the Bosphorus towards the Black Sea.

Credit: Yörük Işık.

Lloyd’s List Intelligence has previously reported on the expansion of Russia’s grain smuggling operations, beyond the occupied port of Sevastopol to include Feodosia port. 

According to the Ukrainian activism, journalism and hacker group, Kiborg News, Grumant used deceptive shipping practices to deliver grain to Latakia, Syria in 2024. The report included several of Grumant’s shipping manifests, which showed it had repeatedly exported grain from Occupied Crimea to Syria. 

Heading Data Helps Locate Grumant

It is standard maritime practice that ships broadcast Automatic Identification System (AIS) messages which include a ship’s position, heading, and draught (among other information).

Because of longstanding Global Navigation Satellite System (GNSS) interference in parts of the Black Sea, the position data transmitted by an affected ship’s AIS system is often unreliable.

Between February 7 and February 19, 2026, data from Lloyd’s List Intelligence shows the Grumant transmitted 29 AIS messages, with unreliable positions in the vicinity of Feodosia. We know these positions are unreliable as they are erratic and some of them report the ship as being positioned on land.

However, according to the IMO, the heading data transmitted by a ship’s AIS system must come from an onboard compass. A compass is unaffected by GNSS interference, meaning it is a more reliable source of information in these conditions.

Over the same dates, all 29 AIS messages reported the ship’s heading as 267 degrees or 268 degrees. The Port of Feodosia has a heading of 267.5 degrees. The close agreement between the ship’s heading and port heading strongly suggests that Grumant was moored at the port between February 7 and February 19, 2026.

We conducted an extra check of the heading data by reviewing satellite imagery available of berth 1 at Feodosia Port, which suggests that the same vessel was present on several days between February 6 and February 18. Imagery on Feb. 6 shows the port was empty in the morning and occupied in the afternoon. Grumant exited the area of GNSS interference on February 21, and berth 1 at the port was captured on satellite image on February 22 and appeared empty. The low resolution satellite imagery is only used as an additional check to see if a vessel is at the berth.

Bellingcat checked all vessels transmitting AIS in the vicinity of Feodosia Port and found that Grumant was the only one that consistently transmitted a heading matching the Port of Feodosia over the period of interest.

We shared our research with Charlie Brown, a former US Naval Officer and Senior Advisor at United Against Nuclear Iran where he focuses on maritime sanctions enforcement and the tracking of illicit shipping. Brown told Bellingcat that while satellite imagery of vessels remained key for identification, when looking for reliable data in a spoofing environment it made sense to look at the various elements of AIS data to try and find some accurate information, despite GNSS spoofing.

“It’s quite standard for the independent gyro compass to be providing the heading […] I think the majority would not [be subject to spoofing] so it’s a good methodology to parse out the particular data and then make some inferences from that.”

“It’s neat to think of what can be derived from data that would otherwise be dirty or wrong. So there’s still some elements of use in there.”

He added that in theory there are probably some compasses that are subject to spoofing as well. 

He told Bellingcat that it was fair to say the heading data of the Grumant supported identification, but stressed the need to cross-reference with other data sources. 

While in this instance it has been possible to use AIS data to help verify the location of Grumant, it is relatively unusual to have access to this information. 

Ships that call to the occupied territories frequently disable their AIS transponders to do so.

This activity, known as “dark port calls”, is a common tactic for those engaging in illicit or sanctioned trades. 

Grumant does not transmit AIS messages from February 8 to 11, but this is the longest gap in data (see diagram above), with intermittent messages coming through after that point.

It is unclear why Grumant continued to transmit AIS during the period it was loading in Feodosia. 

A review of Lloyd’s List Intelligence data from January 2025 shows that on a previous voyage to the Black Sea the Grumant operated “dark” for 59 days.  

Visual Identification

On February 15, 2026, high resolution imagery showed Grumant docked in the Port of Feodosia. We compared it with other recent images of Grumant to confirm the match. 

The ship in the satellite image has a grey-coloured deck, which is uncommon enough for it to stand out. Many bulk carriers have cranes (including the ships we previously covered such as Krasnodar, Zafar and Zaid), Grumant does not have any. It also has seven hatches (openings for the grain) and a bright yellow front mast that matches the mast of Grumant (see the image of it transiting the Bosphorus). We can match the Grumant in the Feodosia image, not only to pictures of the Grumant shot from the ground, but also to the satellite image from Benghazi.

The length and breadth of the ship also matches that of the Grumant; 180 metres by 22.90 metres. 

Libya’s Relationship with Russia and Ukraine 

Libya has complicated internal dynamics with essentially two administrations in charge of different parts of the country – the Government of National Unity (GNU) in the west and the Libyan National Army (LNA) in the east.

In recent years, Russia has backed the LNA’s General Khalifa Haftar, based out of Benghazi, in the east of the country. But Jalel Harchaoui, a political scientist specialising in Libya with the Royal United Services Institute (RUSI), stressed that the two sides of this conflict, the LNA and the UN-recognised GNU, are not currently fighting. Instead they are in a flawed, multi-year truce.

Therefore, the east-west divide isn’t as clear-cut as during the civil war. While all shipments going to Benghazi and Tobruk are overseen by the LNA, not all shipments going to the city of Misrata (which is run by the GNU) are meant for the GNU-dominated part of the country. 

Harchaoui told Bellingcat: “the Tripoli government is in some regards pro-Ukraine, but if there’s business that can be done with Russia through the very opaque port of Misrata and all the right people get paid, the business is going to take place.”

That observation is potentially significant given at least one previously tracked vessel that went from occupied Ukraine to Libya docked in Misrata.

This was not the case of the Grumant, however, which arrived in an LNA-controlled part of the country. It is not known from open sources alone if the authorities in Libya or at the port in Benghazi knew the grain carried by Grumant had come from occupied Ukraine.

Bellingcat contacted the Benghazi-based LNA government and representatives of the Tripoli-based GNU government via the Libyan Embassy in The Netherlands. We also contacted the Port of Benghazi, Port of Imzir in Turkey as well as the Ukrainian and Russian authorities. Representatives of the LNA did not respond to requests for comment before publication, nor did the Port of Benghazi or Port of Izmir. The Libyan Embassy in The Netherlands replied to Bellingcat after publication, stating that Benghazi and eastern Libya are not under the authority or administrative control of the Government of National Unity and therefore they are not currently in a position to comment on Bellingcat’s findings.

Ukraine Continues to Pursue the “Shadow Grain Fleet”

“The port of Feodosia, located in the temporarily occupied Autonomous Republic of Crimea, is not under Ukrainian control, and any commercial activity conducted there is illegal,” the Ministry for Development of Communities and Territories of Ukraine and the Ministry of Foreign Affairs of Ukraine told Bellingcat in a joint response. 

They told us the loading of grain exported from the temporarily occupied territories is an illegal act and Russia was using ports as logistics centers to export stolen Ukrainian agricultural products.

“The expansion of such routes to third countries, in particular to North Africa, demonstrates Russia’s ongoing efforts to circumvent international sanctions and monetize resources stolen from the occupied Ukrainian territories.” 

The Ukrainian Ministry of Foreign Affairs sent information about Grumant’s (IMO: 9385879) “illegal activities” to the diplomatic missions in Great Britain, the Republic of Turkey and the Republic of Tunisia over the course of March to May this year, the ministries told Bellingcat. 

Ukraine is continuing to pursue legal action against Russia’s “shadow grain fleet” they told us. For instance, earlier this month a Swedish court approved the transfer of the Russian “shadow grain fleet” vessel CAFFA to Ukraine for investigation after it was arrested in Swedish waters. 

This case has set a new precedent, going beyond sanction and fines previously handed out to such vessels, and allowing for the detention and confiscation of a shadow fleet vessel in European jurisdictions, the ministries said.

According to Russian court documents Grumant’s previous owner Murmansk Shipping Company was dissolved and “Decision/Reshenie” LLC were listed as the International Safety Manager and operator of Grumant. Decision/Reshenie were also listed as the operator of Grumant in another court document, from an unrelated case. 

Bellingcat attempted to contact Decision/Reshenie to ask about Grumant’s grain shipment from Feodisia Port to Benghazi Port, but they had not responded at time of publication.

Youri van der Weide, Galen Reich, Yörük Işık and Bridget Diakun contributed to this report.

Cover image: Planet Lab image shows Grumant anchored off Izmir, Turkey on February 27. Credit: Planet Labs PBC.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

The post Heading Off: New Technique Helps Track Grain Smuggling Expansion to Libya appeared first on bellingcat.

“In the age of misinformation, the line between fact and fiction is blurrier than ever.”

“For those of us working in video news, verification isn’t a nice-to-have. It’s a necessity. It is how we protect the stories we help shape and how we earn and maintain trust in an increasingly chaotic information ecosystem,” Abu Dhabi-registered video news agency Viory posted on LinkedIn on April 9, 2026, offering training to help newsrooms and journalists sort fact from fiction. 

The self-described “video news agency of the Global South” has delivered journalism training to multiple national press agencies across Africa, Asia and the Middle East.

However, when it comes to Viory itself, the line between fact and fiction is very blurry indeed. 

Bellingcat has found multiple links between the digital infrastructure of Viory and Ruptly news agency, a branch of sanctioned Russian propaganda outlet Russia Today, including shared IP addresses, a Viory-linked site using a digital security certificate registered to Ruptly, and Ruptly sending site performance data to Viory. While there have been previous reports on suspected links between the two outlets, our investigation adds new evidence about Viory’s ties to Ruptly media. 

When contacted for comment, both Viory and Ruptly denied any connection with each other.

‘Video News Agency of the Global South’

Viory’s main offering is raw video footage of news events provided via subscription. According to Viory, its clients include “major international news outlets, local media organisations, and independent creatives in more than 170 countries”.

If its own figures are to be believed, Viory was strikingly well established at its launch in November 2023, by which time it claimed to have a “pre-assembled team of over 150 full-time staff, and an established network of over 3,000 video journalists across the world”.

The name “Viory” is a trade name. The company’s legal name is Darpo Vision FZ LLC, according to its website, which also states that it is registered in Abu Dhabi. In August 2024, Darpo Vision FZ LLC filed for a trademark in the US for the name Viory, which was approved in December of 2025. 

As of May 2026, Bellingcat found press releases and news reports referencing at least 30 agreements between Viory and partners in more than 22 countries, as well as cooperation agreements with government agencies, training agreements with universities and regional journalism bodies. 

This includes:

• African Union of Broadcasting
• Mali’s Office de radiodiffusion et de télévision du Mali
• Democratic Republic of Congo’s Congolese Press Agency 
• Public Service Media Maldives 
• Namibian Broadcasting Corporation
• Ethiopian Broadcasting Corporation
• Cambodia’s Ministry of Information
• Media Office of the Government of Al Fujairah
• Abu Dhabi University
• University of Sharjah
• Asia Media Summit

Viory also sponsored a glitzy event for its inaugural Global South Video News Awards in December 2025 at Abu Dhabi’s first-ever BRIDGE Summit.

Ruptly Revisited

Ruptly is a video news agency formerly based in Berlin and ultimately controlled by Russia Today (RT), which is owned by Russian state media company ANO TV-Novosti. ANO TV-Novosti has been on the EU sanctions list since December 2022 for spreading “pro-Kremlin propaganda and disinformation” and supporting Russia’s war against Ukraine. 

RT launched Ruptly, which operated in Berlin via a German-registered subsidiary in 2013, with the goal of “becom[ing] the go-to alternative resource in a highly concentrated market of professional news video footage, and to deliver coverage of stories that other agencies miss.”

Sanctions imposed on RT following Russia’s 2022 invasion of Ukraine choked off Ruptly’s source of funds in Germany, leading the German company to begin insolvency proceedings in October 2024. Ruptly continues to operate from Moscow as of 2026.

As with Viory, Ruptly’s main offering is providing raw news footage to subscribers around the world. It relies on a large network of international freelancers and stringers. In 2016 RT claimed that Ruptly had “surpassed” newswire services AFP and Reuters on YouTube, and was serving more than 600 media organisations in 45 countries.

Felix Huesmann of the German outlet RedaktionsNetzwerk Deutschland (RND), was the first to outline links between Ruptly and Viory while covering the insolvency proceedings of Ruptly. He found that Darpo Vision’s original details on the Abu Dhabi Creative Media Authority’s site included an email address d.toktosunova@gmail.com. It has not been confirmed who this email address belongs to; however, the username matches the first name initial and surname of Dinara Toktosunova, the managing director of Ruptly. When asked about this email address by Huesmann  in 2024, Ruptly “explained that Toktosunova is focused on securing the future of the Ruptly team [in Moscow] and is not working anywhere else as a managing director.”The activist group, OSINT For Ukraine, also outlined links between Ruptly and Viory, including the movement of multiple key staff between the two organisations and strong similarities between the two organisations’ platforms and content.

Darpo Vision’s Security Certificate

The legal entity behind Viory, Darpo Vision, was set up in one of Abu Dhabi’s free zones – special economic areas that have business-friendly incentives such as tax exemptions and that allow 100 percent foreign ownership. The free zones also offer what some describe as high levels of “corporate privacy,”  which others assert has created a haven for shell companies and opaque corporate structures.

Darpo Vision initially had its own web domain, darpo.vision. The site has since been removed. Whois records show that the domain was registered by Darpo Vision FZ LLC in December 2022 to a PO Box in Abu Dhabi, using a Russian domain name registrar and a Moscow phone number. 

Initially, Darpo.vision had its own Secure Sockets Layer (SSL) certificate – a digital certificate that authenticates a website’s identity, allowing it to secure and encrypt data. However, VirusTotal data shows that as of at least June 2024, darpo.vision was using a wildcard SSL certificate registered to ruptly.video. A Wildcard SSL certificate is a single certificate with a wildcard character (*) in the domain name field. This allows the certificate to secure a single domain and multiple subdomains. You can see historical SSL certificates for darpo.vision.

James Wilson, a software and networking engineer with 20 years of experience and currently Enterprise Technology editor at Risky Business Media, told Bellingcat that to prevent unauthorised use or forgery of SSL certificates, a private key is needed to create and use a wildcard certificate across multiple domains. 

“The fact that darpo.vision was using a wildcard SSL certificate for ruptly.video indicates that whoever was running darpo.vision also had access to the private key for ruptly.video’s SSL certificate. Normally, only the people operating Ruptly’s web hosting infrastructure would be likely to have access to that,” Wilson explained. 

When asked by Bellingcat about whether there were alternative possible explanations, Wilson suggested that it was theoretically possible that someone may have hacked Ruptly and stolen their private SSL key. 

“However, using that wildcard SSL certificate on a domain that didn’t match the wildcard in the certificate defies explanation as the browser would alert the user to the certificate error,” he added.

Shared IP Addresses

Bellingcat also identified multiple shared IP addresses which appeared to be concurrently in use by both Ruptly and Viory between May 2025 and May 2026. 

From 2025 onwards, the Russian IP address 158.160.132.25 has been used concurrently by viory.video, ruptly.video, ruptly.agency and ruptly.tv, according to VirusTotal. Similarly, since the beginning of 2026, IP address 84.252.135.88 has been used concurrently by viory.video, viory.team, ruptly.video, ruptly.agency and ruptly.tv, according to VirusTotal. 

VirusTotal data shows that from 2025 onwards, IP address 158.160.166.22 has been used by ruptly.video and viory.video while from 2026 onwards, IP address 158.160.226.68 has been used by viory.video and ruptly.tv. The VirusTotal data appears to show these IP addresses being used exclusively by Ruptly and Viory as of 2025 and 2026. However, VirusTotal does not necessarily capture all domains which resolve to an IP, and other domains may also have resolved to these IP addresses, which were not observed by VirusTotal’s passive DNS replication service. It is also important to note that in some cases, unrelated domains use the same IP addresses.

Ruptly Sends Site Performance Data to Viory

Viory’s and Ruptly’s site infrastructure was also linked through data sent via Sentry, an internal error tracking and performance monitoring platform. 

An API scan of Ruptly’s main client login page, ruptly.agency, on March 26, 2026, shows that the page was sending data to a subdomain of viory.team. This domain appears to be used by Viory primarily for backend purposes, based on subdomains which appear to refer to common developer and site management tools such as Traefik and ArgoCD, in addition to Sentry.io. Notably, two subdomains also appear to refer to Ruptly. 

The purpose of one domain sending data to another domain’s Sentry project is generally to consolidate all of the relevant performance and error data in one place for in-house developers to monitor. 

The ruptly.agency page’s request to viory.team also includes an authentication key for Viory’s Sentry project. Ruptly.agency is not the only Ruptly domain sending Sentry data to viory.team. As of May 9, 2026 the login page for ruptly.video’s own Sentry project, sentry.ops.ruptly.video, automatically redirects to sentry.ops.ruptly.video/auth/login/viory/. Ruptly Video’s Sentry login page also features “Viory” as the title.

The ruptly.video Sentry login page is also sending data to the viory.team Sentry project, the ruptly.agency homepage and using a favicon hosted on viory.team.

A third Ruptly domain, ruptly.tv, also sends performance data to viory.team’s Sentry project via cms.dev.ruptly.tv. 

James Wilson noted that in each case, the Ruptly domains sending data to Viory appeared to be using a different Sentry key.

“If you look at each of these snippets sending telemetry data [from the Ruptly domains], the specific Sentry keys for sentry.ops.viory.team are different for each. I presume that someone with access to Viory’s Sentry keys has generated and included fresh Sentry keys in each of these instances in order to differentiate between the telemetry from this site versus others using the same Sentry instance,” Wilson said. 

“This cuts against the idea that this is, for example, a case of someone just lazily copy-pasting code on Ruptly’s domains. It suggests that each of these snippets was likely to have been deliberately included. The alternative explanation of changing these API keys to some arbitrary value seems much less plausible given the lack of diligence in ensuring other aspects of the content didn’t cross-reference the domains.”

‘Ruptly’ Page Title on Viory Test Page

Finally, Bellingcat found a page at frontend.dev.viory.video/en that appears likely to be a developer test page for the front page of Viory’s main domain viory.video.

Notably, however, the page title reads “Stream trending news | Ruptly.” The page description included in the source code also refers to Ruptly:  

“Follow breaking world news in real-time and stream the latest developments in politics, sports, finance, science, tech, and more from one of the top online news sites. Download and share international news today with award-winning news agency Ruptl” [sic].

Wilson said that the use of the Ruply page title and text on the Viory test page “looks like a case of lazy copy and pasting”.

“That could potentially be done by someone outside of Ruptly, although it would be strange.”

While this particular piece lies on the lower end of the spectrum of proof, Wilson said that together with the other stronger pieces of evidence, including multiple Ruptly domains appearing to send data to Viory using different API keys, and Ruptly’s wildcard SSL certificate on Darpo Vision’s site, the weight of evidence for a connection between Ruptly and Viory adds up.

“None of the pieces of evidence are watertight on their own, but when you add them together it’s difficult to think of other plausible explanations for all of them being true at the same time,” he added.

Bellingcat also found that Ruptly appears to have connections to a company in Hong Kong. Company records from July 2022 indicate that this company was originally named Ruptly Limited, but in September of that year, the company’s name was changed to Lotus Production Limited. 

The Hong Kong company remains registered as active and filed annual reports in September 2025.

Russian Slant in the ‘Global South’ 

Anna Hiller, a Bangkok-based Consultant Research Analyst for the Institute for Strategic Dialogue told Bellingcat that the resources provided by Viory can be an attractive pool of source material for smaller media outlets, governments and academic institutions with small budgets.

She told Bellingcat that Viory’s editorial choices are clear when looking at the site’s videos.

“When accessing Viory, the prominence of pro-Russian and pro-China content is immediately noticeable, including numerous articles focused on Vladimir Putin, Russia-China cooperation, and broader China-related narratives.”  

Bellingcat contacted Viory, Darpo Vision and Lotus Production Limited to ask about the connections we found between the Viory website and Ruptly and between Lotus Production Limited and Ruptly. 

Viory said that it had no connection with Ruptly. “Viory has no connection with Ruptly; any suggestion otherwise based on ordinary use of similar digital platforms, tools or cloud providers is poorly founded and inaccurate; Viory is a UAE-based, privately held, self-funded and 100% privately owned organisation, and receives no funding, direction or instructions from any state media,” the company said in an email response. 

Ruptly also said it was not connected to Viory. It declined to respond to Bellingcat’s questions, including about specific findings such as Ruptly’s domains sending technical performance and error data to Viory, calling these questions “irrelevant”.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

The post Tracing Digital Links Between Viory and Ruptly appeared first on bellingcat.

The fragile ceasefire agreed between Israel and Hezbollah last month is holding. 

But satellite imagery shows that at least 46 of 54 towns and villages within the Israel Defense Forces (IDF) “Yellow Line” in southern Lebanon have been heavily damaged or, in some cases, entirely flattened. 

Much of the destruction and demolition has taken place in recent weeks.

Bellingcat’s satellite imagery analysis examined towns and villages identified on OpenStreetMap, a community-driven map database. Medium resolution PlanetScope satellite imagery covering each of the locations was provided by Planet Labs, a US company that recently restricted some of its imagery in the Middle East.

Bellingcat is sharing the annotated PlanetScope imagery for the dates of March 2 and May 8, 2026, showing the scale of damage that has occurred during roughly the first two months of the US-Israeli war against Iran.

The towns and villages detailed in the map are colour coded. Red shows locations  that have suffered varying degrees of damage or destruction, while yellow shows locations that were damaged prior to the US-Israeli war with Iran. White shows locations that have not been significantly damaged at time of publication.

Scroll and zoom to see damage throughout southern Lebanon in each of the date tabs. The first image is from March 2, 2026, shortly after the US and Israel attacked Iran. The second image is from May 8, 2026, more than two months after the start of the war and amid a fragile ceasefire between Israel and Hezbollah. PlanetScope imagery via Planet Labs PBC.

Israel’s Defence Minister, Israel Katz, is reported to have stated that “all homes in Lebanese villages near the border will be destroyed — in accordance with the Rafah and Beit Hanoun model in Gaza”. The aim, Katz said, is to “remove, once and for all, the threats near the border”. Israel has adopted similar methods of flattening buildings and homes close to Israel’s border in Gaza.

The large-scale destruction in southern Lebanon has been reported by multiple outlets including the BBC, CNN, SkyNews and The New York Times. These reports have shared images from several towns and villages, but Bellingcat is publishing satellite imagery for the entirety of southern Lebanon. The changes between the two dates show the scale and pace of destruction.

Take our survey

Help shape the future of our collective.

Take our survey

Within the Yellow Line  — the area occupied by the IDF since a ceasefire was agreed between Hezbollah and Israel on April 16 —  some towns were reported already destroyed or heavily damaged during the 2024 Israeli invasion of southern Lebanon. Some — like the coastal border town of Naqoura or the southeastern border town of Kfar Kila — have now been largely demolished. This is visible in both the medium-resolution PlanetScope imagery, and in high-resolution imagery obtained from Airbus by the BBC.   

Everything south of Lebanon’s Litani and Zahrani Rivers has been under evacuation orders issued by the IDF since early March, with regular updates warning residents to leave ahead of airstrikes. 

Much of the destruction within the “Yellow Line” appears to be from either controlled demolitions using explosives or construction vehicles. The IDF has shared numerous videos showing large-scale demolitions conducted in the towns and villages in southern Lebanon, while videos shared elsewhere on social media show the aftermath — large parts of towns like Beit Lif or Kheim reduced to rubble. 

One particularly large explosion took place in the small village of Qantara, where the IDF says it found two large tunnel systems built by Hezbollah. 

The tunnels were detonated with 450 tonnes of explosives, leaving large parts of the village obliterated. Another video released by the IDF showed some of the few remaining buildings in the nearby village of Aadashit being demolished with explosives. The IDF claimed the buildings were “Hezbollah infrastructure”.

Before and after imagery from Planet Labs shows the villages of Qantara and Aadshit in southern Lebanon on March 2 and April 30, 2026. The April imagery shows the aftermath of two large demolitions conducted by the IDF. Large parts of both villages have also been demolished. The UNP 7-1 label details the position of a UN peacekeepers facility.

Bellingcat contacted the IDF for comment on the details in this story but did not receive a response before publication. 

A full size version of the map can be found here.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

The post Satellite Imagery Shows Ongoing Demolitions Across Southern Lebanon appeared first on bellingcat.

Bellingcat has identified at least 80 police stations or infrastructure related to law enforcement agencies and the Basij paramilitary group that has been damaged or destroyed in the first three weeks of the United States and Israel’s war against Iran. Experts told Bellingcat that both countries aim to degrade the Iranian regime’s “repressive capacity”.

Combined, the US and Israel have conducted thousands of strikes during the course of the 2026 war in Iran. Targets range from Islamic Revolutionary Guard Corps (IRGC) sites, Navy vessels to Iranian weapons manufacturers.

In early March, a Bellingcat analysis using satellite imagery and available photos and videos identified police stations as another apparent target, with at least 15 damaged or destroyed in the capital, Tehran.

We also identified multiple strikes against police infrastructure in the country’s north and west; these areas were targeted by the Israel Defence Forces according to a map released by the IDF on March 31.

“We are providing the brave people of Iran with the conditions to take their destiny into their own hands,” declared the Israeli Ministry of Foreign Affairs official X account, along with a photo of a destroyed police station.

اینجا کلانتری ۱۲۱ سلیمانیه در خیابان نبرد تهران بود.

ما شرایطی را برای مردم شجاع ایران فراهم می‌کنیم تا سرنوشت خود را در دست بگیرند. pic.twitter.com/VSm6YVvIwZ

— اسرائیل به فارسی (@IsraelPersian) March 5, 2026

In all, the majority of strikes Bellingcat analysed focused on police stations (30 incidents) and command centers or headquarters (29 incidents). Locations also include sites related to Basij, a plainclothes paramilitary organisation (9) affiliated with the IRGC that were “involved in the deadly crackdown” of protests in January 2026, others are associated with special forces (3) and traffic (2) or diplomatic (2) police compounds.

Related articles by Bellingcat

Investigations

Satellite Imagery Reveals Strikes on Iranian Police Stations

Due to commercial satellite companies limiting access to imagery over Iran and neighbouring countries we relied on Sentinel-2 imagery data to help verify the incidents, as well as videos and photos, some of which were also verified by independent geolocators and contributors to the Geoconfirmed volunteer community and confirmed by Bellingcat researchers. 

Location data was partly determined using open source mapping data either from Wikimapia, OpenStreetMap or Google Maps. When video footage or photos were available for incidents reportedly targeting police stations, the location was verified with geolocation and satellite imagery analysis using either Planet Labs medium resolution PlanetScope data (restricted to imagery collected by March 9) or low resolution Sentinel-2 data.

Some locations were discovered utilising location data taken from OpenStreetMap using Overpass Turbo and comparing that with available Sentinel-2 data throughout Iran.

Map showing geolocated incidents in Iran. Click the markers to view the coordinates, sources, and verification notes. Map: Bellingcat/Miguel Ramalho

A Problem of Scale

Israel has released multiple videos showing the targeting of bases and checkpoints belonging to the Basij. In mid-March, the IDF announced the killing of the paramilitary group’s commander, Gholamreza Soleimani. 

Targeting the Basij is part of Israel’s and the US’ agenda “to degrade the regime’s repressive capacity,” Ali Vaez, the director of International Crisis Group Iran Project, told Bellingcat. Police stations are “not involved in repression in the way that crowd control police or Basij centers are”, so targeting them “appears more aimed at preventing the Islamic Republic from being able to maintain control internally,” he said.

Support Bellingcat

Your donations directly contribute to our ability to publish groundbreaking investigations and uncover wrongdoing around the world.

Donate

Vaez told Bellingcat that, when considered alongside the broader range of targets, including industrial factories, the widespread targeting of police stations is part of a strategy “to make Iran ungovernable for the existing regime or whatever comes after”. 

Vaez was skeptical about the short term effects: “It’s a problem of scale. Iran is such a large country, even if you are able to completely destroy, not just degrade, the capacity of the regime in policing, oppressing, etc – it really requires not just maybe weeks but maybe months if not years.”

The Risk of Civilian Casualties

As of April 7, the Iranian Human Rights Activists News Agency estimates there’ve been more than 1,700 civilian fatalities during the war. 

Several police stations are situated in densely populated urban areas such as Tehran. Stations are used by civilians for various reasons including renewing driving licences, so if these buildings are targeted “during working hours and not in the middle of the night then risk is higher for these people,” Vaez said.

Map showing geolocated incidents in Tehran. Click the markers to view the coordinates, sources, and verification notes. Map: Bellingcat/Miguel Ramalho

A recent joint Airwars, Center for Civilians in Conflict and Human Rights Activists in Iran report detailing the first month of civilian casualties included a section on the worsening situation for detainees in Iranian prisons — including police stations that have been targeted. 

“I was detained in the holding cell of [Police Station 148] for ten days, along with four other activists. Now it looks like nothing is left of that station but ruins. I can’t even recognize where the detention area was. I keep wondering what happened to the people who were being held there during the attack. – Activist, told HRA upon seeing photos of the police station after recent US/Israeli airstrikes.”

Footage shared and geolocated by the BBC’s Shayan Sardarizadeh showed Police Station 148 damaged after an apparent strike in mid-March.

The main building of Tehran’s 148 police station and its courtyard, located on Enghelab Street, has been severely damaged in air strikes conducted on Friday.

The adjacent Hamoon Theatre also sustained some damage.

Video: @Vahid

Location: 35.700812, 51.402163@GeoConfirmed pic.twitter.com/9sdOtHd2XN

— Shayan Sardarizadeh (@Shayan86) March 14, 2026

One destroyed police station identified by Bellingcat in the city of Mahabad in northwestern Iran led to apparent damage to an Iranian Red Crescent Society building located next door. According to Iran’s Tasnim News agency (an IRGC-affiliated media outlet sanctioned by the EU, the US and Canada), one Red Crescent employee was injured in the attack.

The police station adjacent to the Red Crescent building isn’t identified on any mapping services, though there are reports “Police Station 11” was targeted the same day.

Israel has also targeted checkpoints operated by Basij members.

Bellingcat examined two cases showing Israeli strikes on checkpoints while civilians were passing. In one video, a strike hits a checkpoint as five motorbikes and a vehicle go by.

In another IDF video, a yellow bus is immediately adjacent to the checkpoint when it is hit. It is unclear how many people were on the bus at the time of the strike or if anyone was injured.

According to the Open Source Munitions Portal (OSMP), Israeli drones commonly employ the Mikholit bomb. A variant of this bomb has 890 grams of explosives, an amount that creates hazardous fragmentation up to 104 meters away. 

“I have been watching the reporting on these Basij strikes and the use of the Mikholit in particular in open urban areas. It is IDF standard—using precision munitions and even sometimes “low collateral” munitions but in a reckless manner that still puts the civilian population at risk,” Wes J. Bryant, a defence and national security analyst formerly with the Pentagon’s Civilian Protection Center of Excellence told Bellingcat.

Questions Over Legality

International Humanitarian Law defines civilians as “persons who are not members of the armed forces”. Police officers fall under that definition, according to Adil Haque, Professor of Law at Rutgers University and Executive Editor at Just Security.  “As a rule, police are civilians and may not be attacked unless they take a direct part in hostilities,” Haque told Bellingcat. National security analyst Bryant agreed, adding that targeting police “does not stand up to legal scrutiny”.

In an email to Bellingcat, the IDF noted “that the police form part of Iran’s internal security apparatus, which also forms part of Iran’s armed forces, under Iran’s own domestic legislation. In every strike, the IDF takes feasible precautions in order to mitigate incidental harm to civilians and civilian objects to the extent possible under the circumstances.”

Police are indeed “part of the country’s armed forces. By that logic, anything with a flag on it is a legitimate target,” Ali Vaez, the director of International Crisis Group Iran Project, said.

Although Basij is a paramilitary group, any strikes against it would require precautions to minimise harm to civilians, Haque told Bellingcat. “Since the hostilities almost entirely involve aerial bombardment, the concrete and direct military advantage anticipated from strikes on Basij members who qualify as combatants is extremely low, so significant harm to nearby civilians would be disproportionate and illegal,” he said.

When asked about potential civilian casualties in the checkpoint strikes, the IDF told Bellingcat that since the Basij are subordinate to the IRGC and are therefore part of the armed forces, they are regarded as lawful military targets. Regarding the checkpoint strikes specifically, they stated “precision munitions and surveillance means were used in the strikes, as part of the precautions taken under the circumstances to mitigate expected incidental harm”.

Bellingcat reached out to US Central Command (CENTCOM) to ask if the US had any role in the police station strikes identified but received no official comment at the time of publication. 

The data collected so far for these sites can be found here.

Miguel Ramalho and Felix Matteo Lommerse contributed to this report.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

The post “Make Iran Ungovernable” – Tracking Efforts To Destroy Iran’s Police Infrastructure appeared first on bellingcat.

Bellingcat has identified several high-profile incidents where authorities in the United Arab Emirates have downplayed damage, mischaracterised interceptions and in some instances not acknowledged successful Iranian drone strikes on the country.

A review of official statements shows that the public account does not always align with what can be observed through open sources. This comes as the UAE faces sustained aerial attacks on civilian and economic infrastructure, challenging its image as a secure global hub for business and tourism. Hours after the United States and Israel launched coordinated attacks on Iran on Feb. 28, the Islamic Republic responded by launching an attack against US-allies in the region including the UAE. 

In the wake of the attacks, the UAE’s attorney general warned that publication of images or videos of strikes was illegal. People were also encouraged to report anyone sharing photos or videos of the strikes to authorities. 

The country’s attorney general has ordered the arrest of 35 people and said they would face an expedited trial for “publishing video clips on social media platforms containing misleading, fabricated content and content that harmed defence measures and glorified acts of military aggression against UAE.” Separately police in Abu Dhabi reported they had arrested just over 100 people on suspicion of filming incidents related to Iran’s attacks on the UAE and sharing misleading information online.

Bellingcat contacted the Dubai Media Office, the Fujairah Media Office as well as the UAE’s Ministry of Defence to understand how statements are put out and how distinctions are made between successful drone strikes and damage caused by debris. We did not receive a response by the time of publication.

“Spreading Rumours is a Crime”

During the first days of the conflict several videos were posted on social media, primarily on X, TikTok and Telegram showing footage of Iranian attacks and interceptions across the UAE. 

Around the same time the Dubai Media Office, the X account of the Government of Dubai’s press office, warned followers that legal action would be taken against those sharing “unverified material”.

 The X account of the Dubai Media Office has more than 2.3 million followers making it one of the largest state-run accounts in the country. 

“The public and media are urged to rely solely on official sources for accurate information and refrain from sharing unverified material,” the account posted.

Dubai Police issued similar warnings on social media, stating that sharing content that contradicts official announcements could lead to imprisonment of at least two years and fines of no less than 200,000 dirhams (approximately $55,000).

Despite authorities urging the public to rely on official sources only, Bellingcat found that some of the videos posted online as well as satellite imagery from the region contradicts a number of official accounts of high-profile attacks. For this piece we have only included links to videos that have already been widely published in mainstream news outlets, posted by professional journalists, or have been widely viewed on social media.

Successful Interceptions?

On March 3, a video filmed from a vessel appears to show a drone striking the port of Fujairah, one of the UAE’s most strategically important energy hubs. The port handles roughly 1.7 million barrels of oil per day and is among the world’s largest.

The drone appears to approach its target intact, with no visible sign of interception, Sam Lair, a researcher at James Martin Center for Nonproliferation Studies, told Bellingcat. 

Moments after it descends behind storage tanks, an explosion is heard and a large plume of smoke rises from the site.

On the same day, the Fujairah Media Office stated that a fire resulted from debris following a successful interception, adding that the fire had been brought under control. Satellite images captured on March 4 and 5 show thick black smoke rising from the site. NASA FIRMS data also detected fires on March 3, March 4 and March 5. By March 7, satellite imagery shows at least three storage tanks fully destroyed (25.184565, 56.345481).

Detained in Dubai, a group that provides legal advice to people detained in the UAE, said that a Vietnamese national who filmed the strike on Fujairah port had been detained by authorities after posting the footage online. 

Authorities made a similar report on March 1, stating that a fire at one of the berths of Jebel Ali Port was caused by debris from an aerial interception. Satellite imagery from the same day shows fires at two separate locations – approximately 3 km apart – within the port. One appears to be a central facility associated with fuel handling operations, connected via pipelines to surrounding storage tanks (25.00704, 55.07499). The other is a large structure (24.97953, 55.05204) in the military area of the port, which is one of the US Navy’s busiest ports in the Middle East. The New York Times previously identified an Iranian strike as the cause of the fire at the site. 

Burj Al Arab: A “Limited” Fire

Damage at Dubai’s Burj Al Arab Hotel was attributed by the Dubai Media Office to “shrapnel” from an intercepted drone and described as a “limited” fire. However, footage shows the fire extended to approximately 30 metres in height, covering approximately eight floors of the building, suggesting a far more significant incident than officially described.  

Lair told Bellingcat that the damage appeared more consistent with a direct impact. He added that if the damage had resulted from an interception it would have occurred irresponsibly close to the building.

Fairmont The Palm: Omission of Cause

On Feb. 28, the Fairmont hotel in Dubai’s Palm Jumeirah area was struck by a drone, as shown in footage verified by Bellingcat.

However the Dubai Media office did not confirm a strike took place, instead they stated  only that an “incident occurred in a building in the Palm Jumeirah area,” and urged the public not to share footage.

One video of the fire was shared by a Dubai-based Bloomberg journalist. In the replies to the journalist’s post, multiple users tagged the Dubai Police, a pattern seen across posts documenting the strikes, in an apparent effort to flag violations of the cyber-crime laws to authorities.  

The aftermath of the strike was also captured by a content-creator who has since left the UAE. 

Radha Stirling, founder of Detained in Dubai, told Bellingcat at least five people have been confirmed by the British embassy to have been charged and detained under the UAE’s cybercrime law in connection with documenting this strike. According to Stirling, authorities have sought access to individuals’ phones following incidents to determine whether they filmed or shared footage.

“Even just taking a photo is illegal, it’s illegal to share content that the government deems negative, even in a private message,” Stirling said.

Dubai International Airport: An Unacknowledged Strike

On March 7, the Dubai Media Office announced the temporary suspension of operations at Dubai International Airport, stating only that a situation was being handled under safety protocols. 

Footage that emerged online around the same time, and was verified by Bellingcat, shows a drone strike next to an airport terminal building (25.24165, 55.37498).

Stirling told Bellingcat that she has been in contact with a cabin crew member who was detained after sending an image to colleagues of Dubai airport after an explosion. 

Warda Complex: A Direct Hit

On March 1, a drone struck a residential apartment on the 19th floor of the Warda complex in Dubai (25.004320, 55.293164). Two videos filmed from different angles show the drone hitting the building directly, with no visible sign of interception. In one clip, filmed inside the apartment, a British resident says: “We’ve just been hit by a drone… I didn’t even finish my cup of tea.”

The footage shows relatively limited damage and no explosion, indicating the drone did not detonate. However, the incident appears to show a direct hit by an Iranian drone.

In contrast, statements published the same day by the Dubai Media Office describe air defence activity and attribute sounds heard across the emirate to successful interception operations. Bellingcat was unable to find any acknowledgement of a direct hit in UAE media.

These cases point to a gap between official accounts and observable evidence, raising questions about how incidents are being presented to the public.

Influencers and Narrative Control

At the same time, pro-government messaging has proliferated online. A number of near-identical videos posted by influencers promoting the UAE’s safety and leadership appeared, often using the format: “You live in Dubai, aren’t you scared?” followed by images of UAE leaders and the response: “No, because I know who protects us.” 

Analysis by the BBC found that some of these videos were uploaded within seconds of each other, suggesting coordinated activity.

Stirling told Bellingcat that influencers in the UAE, who require licences to operate, are often paid to promote official narratives. “They are seen as an asset,” she said, describing them as “almost an extension of the government.”

As of April 1, UAE media reported that a total of 12 people had been killed and 190 injured by strikes since the beginning of the war.  

“People are dying. It’s not as safe as the government is reporting. It’s not as safe as influencers are reporting. It’s like a dream narrative that you wish was true.” Stirling said.

Bellingcat also identified a number of incidents in which authorities reported deaths or injuries caused by “debris” following “successful interceptions”. In these cases, however, we were unable to identify supporting photo, video, or other independently verifiable evidence to corroborate the official account.

Notably, fewer videos of such incidents appear to have emerged online in recent weeks, likely as public awareness of detentions under the cyber-criminality law has increased.

Jonathan Dagher, head of the Middle East desk at Reporters Without Borders told Bellingcat that the UAE government was using the Iran war to further restrict independent reporting in the country. 

“When the conflict began, the government stepped up this repression, explicitly prohibiting the public (including journalists) from publishing photos or information related to the strikes, and encouraging the public to report on such incidents.”  

He added that legitimate concerns about national security should not infringe on the public’s right to information. 

“Broad and loosely worded bans on covering events, in the name of security, violate this right and expose journalists to arrest and violence.”

Bellingcat contacted the Dubai Media Office, the Fujairah Media Office as well as the UAE’s Ministry of Defence to understand how statements are put out and how distinctions are made between successful drone strikes and damage caused by debris. We did not receive a response by the time of publication.

Lana Nusseibeh, a representative of the UAE’s Foreign Ministry previously told the BBC: 

“In order for everyone to feel safe it’s important at this time that the information is credible and the sources are reliable. That is the basis of the legislation that has come into play in this State, which is obviously a tense time.” 

She added that her advice for residents, citizens, tourists and journalists in the UAE was to: “Follow the guidelines. The guidelines are there for your safety and for your protection.” 

Merel Zoet contributed to this report.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

The post The War You’re Not Allowed to See: How the UAE Rewrites the Story of Iranian Strikes appeared first on bellingcat.

Bellingcat has geolocated and verified two new videos showing the deadly strikes that hit an Iranian Revolutionary Guard Corps (IRGC) compound as well as an adjacent school in the city of Minab in late February.

The new videos were released by Iran’s Ministry of Foreign Affairs and show multiple missiles hitting the complex. 

One of the new videos shows the area around the school being struck while the other shows a nearby IRGC clinic and two buildings within the IRGC facility being hit by Tomahawk missiles. 

Support Bellingcat

Your donations directly contribute to our ability to publish groundbreaking investigations and uncover wrongdoing around the world.

Donate

Visual and solar analysis of the videos appears to show there was a time gap between when each was filmed, suggesting that there were at least two waves of strikes carried out in the area. 

Applying the same solar analysis techniques to social media footage that showed the school after it had been hit indicates the school was impacted during the first wave of strikes.

Previous investigations by Bellingcat and other news organisations showed a US Tomahawk missile struck the IRGC facility on Feb. 28. 

The US is the only party to the conflict to possess Tomahawk missiles.

Media reports, including from the New York Times and Reuters, have since detailed that a preliminary investigation by the US military concluded it was likely a US strike that hit the Shajarah Tayyebeh elementary school.

According to Iranian media, at least 175 people were killed in the attack, including children.

Analysing New Minab Videos

The first video (video one) is filmed from just over 2.5 kilometres (1.5 miles) away from the IRGC base and shows at least 10 missiles impacting the area over a period of 50 seconds.

The first explosion is visible five seconds into the video. The area around where the school was located is struck at 14 seconds. This is the fourth explosion visible in the footage.

Another structure that was damaged in the strikes is situated approximately 100 metres away from the school in the same general area. It was therefore not possible to determine which exact structure was hit from this footage alone.

The second new video (video two) was filmed approximately two kilometres southeast of the school, and is of a higher quality than video one. This video shows three Tomahawk missiles in the moments before impact.

Video two includes annotations and pauses when each Tomahawk appears on screen. 

A frame-by-frame analysis also shows what appear to be two minor visual glitches where some frames are transposed and annotations were added, highlighting when missiles can be seen.

The second impact seen in video two is the same as seen in footage released by Iranian media in early March, and previously reported on by Bellingcat and others, only from a different perspective.

Video two also only shows the southern part of the base, with its northern section not visible. The school is located on the northern edge of the base and is therefore not visible in video two.

Bellingcat asked the Iranian Ministry of Foreign Affairs why only part of the strike, as seen in video one, was released and if there was a longer version that may show further impacts. We did not receive a response before publication.

Bellingcat also asked the US Department of Defense whether it had any further information on the strike since its reported preliminary findings. It referred us to CENTCOM, which said: “We have nothing for you on this. The investigation is still ongoing.”

Geolocating the Videos

Bellingcat was able to geolocate and verify video one by tracing sightlines on satellite imagery to determine the camera’s location and identify objects such as buildings, trees and a water tower within the IRGC facility. 

According to this analysis, video one was most likely filmed from an electric substation southeast of the school.

Once all key elements were identified and geolocated, we analysed each explosion that can be seen in the footage. 

Fourteen seconds into video one, the fourth impact appears to hit the area immediately around the school, which was approximately 200 meters behind a water tower. 

While the school was walled off and outside the IRGC facility, the water tower and another building (situated between the school and the water tower) are located within it.

Due to the relatively small distance between the school and the other IRGC building (roughly 100m), it was not possible to determine what structure was hit at the moment of the strike visible in video one.

More information, such as obtaining the entire strike video sequence, would be needed to fully determine which structure was hit in this footage. However, social media footage captured at the scene does suggest that the school was hit around this time.

For video two, we stitched together a rough panorama of what could be seen in the footage. 

This made it possible to match up multiple buildings visible southeast of the IRGC base and school, while also building rough sightlines to show which part of the base was being filmed.

Bellingcat was able to narrow down the areas hit by the three missiles seen in video two by comparing it with the point of view of a short video released in early March, showing a Tomahawk hitting the complex, as well as with what could be seen in video one. Post-strike satellite imagery also helped confirm the buildings that were hit in the footage. 

We were thus able to determine that video two shows an IRGC clinic and two buildings within the IRGC compound being hit.

Time of the Strikes

The Iranian Ministry of Foreign Affairs has claimed that two waves of strikes occurred. 

Initial analysis did suggest that video one and two appeared to be filmed at different times as the strikes visible in each clip cannot be synced up. 

Solar data also gives clues as to the time each was taken, suggesting that there was a time gap of at least an hour between the strikes seen in the two videos.

According to the New York Times, the strikes were first reported on social media just after 11:30 am.

Solar data, derived by the direction of shadows visible in video one and simulated via the SunCalc platform, appears to indicate it was filmed between 10:30 and 11:30am.

Analysing the shadows seen in the earlier March video using the same method, appears to show that it was filmed between 13:30 and 14:30. 

This would seem to indicate that video two and the earlier March video were likely filmed after video one.

Solar data from a video posted to Telegram showing the smouldering school, and damage to the nearby IRGC building about 100m away, shows that it was recorded around the time of the first video.

This, therefore, appears to confirm that the school was impacted before the wave of attacks seen in video two.

Iranian media previously released images of munition remnants they claim they recovered from the school. 

Bellingcat was not able to verify where the remnants were originally found, but was able to identify them as Tomahawk missile remnants. The New York Times also confirmed this identification by matching the contract number on a remnant to a contract for the Tomahawk missile.

Bellingcat’s Carlos Gonzales, Jake Godin and Trevor Ball contributed research to this article.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

The post Two Waves of Bombing: New Videos Reveal Further Details About Iran School Strike appeared first on bellingcat.

The US appears to have deployed the Gator Scatterable Mine system over Kafari, a village near Shiraz, in southern Iran overnight. Several people were killed according to Iranian media. 

Three experts told Bellingcat the munitions appeared to be air-delivered US-made Gator anti-tank mines. 

The US is the only participant in the Iran war known to possess Gator Scatterable Mines. 

Bellingcat asked the US Department of Defense whether it had dropped the mines overnight, but did not receive a response at time of publication.

Dr NR Jenzen-Jones, Director of Armament Research Services, told Bellingcat that the images appeared to show US-made anti-tank landmines. 

“These images show what appear to be American BLU-91/B scatterable anti-tank landmines. 

“The BLU-91/B is dispensed from the CBU-78/B or CBU-89/B air-delivered cargo bombs (cluster munitions). 

“The presence of square ‘aeroballistic adaptors’ indicates that the mines seen here were delivered by air. Similar mines can be dispensed from the vehicle- or helicopter-based Volcano system.”

Amael Kotlarski, Weapons Team leader at Janes, also identified the mines as BLU-91/B ‘Gator’ anti-tank mines. Kotlarski told Bellingcat “the BLU-91/B is dispensed from either the US Air Force’s CBU-89/B (72 BLU-91/B and 22 BLU-92/B) or the US Navy’s CBU-78/B (45 BLU-91/B and 15 BLU-92/B).”

He elaborated that the BLU/92B is an anti-personnel mine, similar in appearance to a BLU/91B, though not identical.

“No BLU-92/B is observable in the photographic evidence presented so far. This could be that they have not been found, or that the dispensers were loaded solely with AT mines to help reduce the risk to civilians.”

Gator Scatterable Mines System

The Gator system is an air-delivered dispenser system or cargo bomb that distributes mines over an area. These dispensers contain a mixture of either 94 or 60 BLU-92/B anti-personnel and BLU-91/B anti-vehicle mines depending on which dispenser is used. These dispensers release the mines over an area of approximately 200 by 650 metres.  In the images reviewed by Bellingcat, it is not clear which dispenser was used, or how many dispensers were deployed.

Andro Mathewson, an independent open source analyst, who formerly worked at landmine-clearing NGO The HALO Trust, told Bellingcat the images showed BLU-91/B mines.

Some of the images of the mines posted by Iranian media show an aeroballistic adaptor. The aeroballistic adaptor is only present on the BLU-91/B and BLU-92/B, not on other mines within the US Family of Scatterable Mines (FASCAM), indicating that these were deployed from a Gator system aircraft dispenser.

BLU-91/B and BLU-92/B Mines and Self-Destruct Features

Both BLU-91/B and BLU-92/B mines are activated two minutes after being deployed; however, a very small number can fail to properly arm and explode. These mines also have self-destruct features with a variable delay which means they may randomly explode hours or days after they are dispensed. They may also explode if disturbed. These features make them particularly dangerous.

The self-destruct can be set for 4 hours, 48 hours, or 15 days, but the mines may self-destruct before then.

So far, only visual evidence of magnetically influenced BLU-91/B anti-tank mines has been posted online, but these mines are usually deployed alongside the anti-personnel BLU-92/B. The BLU-92/B also deploys tripwires.

In addition to the self-destruct features, the BLU-92/B anti-personnel mines have an anti-handling device (AHD) that is intended to make the mine explode when disturbed. While BLU-91/B anti-tank mines do not have an anti-handling device (AHD), they “may detonate when moved, because the mine may sense a significant change from its original orientation.”

Amael Kotlarski of Janes told Bellingcat that “The mine will go off if subjected to significant movement.” This could explain local reports that a man was killed when he picked one up near his car. 

Uniquely US Weapons

The US is the only participant in the war known to possess these mines. They were developed after the US stopped supplying arms to Iran. A review of Stockholm International Peace Research Institute’s (SIPRI) Arms Transfer Database, and US Major Arms Sales does not show any transfers of these mines to Israel.

Dr Jenzen-Jones also told Bellingcat that “Scatterable anti-tank landmines may have been employed to deny vehicles access to or from so-called ‘missile cities’. This could both prevent TELs [missile launch vehicles] from leaving, and limit efforts to re-establish access to facilities (for example, by preventing excavators from operating at collapsed entrances).”

Bellingcat geolocated some of the mines to the village of Kafari, Iran (coordinates 29.50544059, 52.48745447 and 29.50964897, 52.48920842). This video shows at least three mines approximately two kilometres away from the entrance to what is reported to be Shiraz South Missile Base, an Iranian “missile city.” 

Bellingcat asked the US Department of Defense to confirm whether they dropped mines in this area, how many were deployed, and what the intended target was. They did not respond at time of publication.

Bellingcat was unable to determine how many more mines were scattered over the village. Some mines may not yet have been found due to where they landed. 

Bellingcat’s Carlos Gonzales and Logan Williams as well as Felix Matteo Lommerse contributed research to this article.

The post Evidence Points to US Scattering Mines over Iranian Village appeared first on bellingcat.

The Netherlands’ largest newspaper, De Telegraaf, recently published an interview with a woman claiming to organise her own evacuation flights from Dubai, selling seats at €1,600 (US$ 1850) each. Four days later, her photo was removed from the article, though the interview remained.

Bellingcat has found that the original image not only includes artefacts commonly associated with generative AI, but that the flights referenced in the article do not appear to exist.

The story came at a time when thousands of Dutch people were reportedly seeking urgent ways to leave the region following Iranian missile and drone strikes across the Gulf in retaliation for US-Israeli strikes.

Published on De Telegraaf’s website on March 5, the headline reads: “Dutch people in the Middle East feel abandoned by the government: We just rented a plane ourselves.”

The Dutch minister of foreign affairs was confronted with this headline during a television interview, in which he described ongoing efforts by the Dutch government to repatriate citizens to the Netherlands.

The article features interviews with several Dutch people struggling to leave Dubai and Abu Dhabi, including Tamara Harema. Under the subheading “Dutch people hire their own plane”, Harema says she was “rebooked five times by Emirates” and that the official repatriation flights organised by the Dutch government were not ‘taking off’.

As part of a group, she says, they are organising buses and have hired an Airbus A321 to fly home. Harema is quoted as saying: “The first plane is already full, so we’re organising a second flight. Stranded travellers can contact us.”

However, several discrepancies in Harema’s photo, published in the original article, suggest it was AI-generated. No trace of a person matching Harema’s face or profile could be found, and flight-tracking data suggests no such plane took off.

The Photo

In the image below, the world’s tallest structure, Burj Khalifa, can be seen through the window overlooking the Dubai skyline. Each side of the tower is unique, with platforms that protrude at different heights and in different directions. It also contains several mechanical floors, which appear as dark bands in the photo.

By cross-checking the height of the visible platforms together with the location of the mechanical floors, it’s possible to determine that Harema’s hotel room faces north-west, towards the Burj Khalifa’s south-east-facing facade.

Several discrepancies are visible when comparing Harema’s photo with other images of the building, including an upper mechanical floor appearing higher than in other images and the absence of the water feature at the base of the building.

To establish whether Harema’s photo could have been taken several years earlier, Google Street View imagery was analysed from 2013 onwards. No match could be found when comparing the arrangement of buildings at the base of the Burj Khalifa.

Several other irregularities, as shown below, including the hotel room furniture and details of Harema’s clothing and jewellery, also suggest it may have been AI-generated.

Fully Booked Airbus A321

Regarding whether the plane existed, Harema says in her interview that buses have already been arranged to collect passengers from two locations in Dubai on Saturday, March 7, after which a 232-seater Airbus A321 will depart from Muscat, Oman, for the Netherlands.

The article notes the cost is €1,600 (US$ 1850) per person, without detours. “Although we read that a Dutch repatriation flight costs €600, just try getting on such a flight,” says Harema.

According to Flightradar24, multiple A321s departed Muscat on March 7 and 8, but none bound for the Netherlands. The only aircraft that did arrive in Amsterdam from Muscat were either government-organised repatriation flights or scheduled Oman Air services, none of which were Airbus A321s.

Two Airbus A321s were recorded on the ground at Muscat Airport on March 7. One, belonging to Gulf Air, later departed for Rome via Riyadh March 8. The other, operated by SalamAir, had been flying routes between Oman and Bangladesh until March 3, but has since remained in Muscat.

Support Bellingcat

Your donations directly contribute to our ability to publish groundbreaking investigations and uncover wrongdoing around the world.

Donate

After contacting De Telegraaf, an explanation for the photo’s removal was added at the bottom of the article, stating that the photo did “likely not meet our journalistic guidelines.”

The newspaper’s deputy editor-in-chief, Joost de Haas, added:

“Regarding the quoted Tamara Harema, the editors contacted her after Mr. Chizki Loonstein—a long-standing source for one of our reporters—informed us about attempts to charter a plane. Mr Loonstein informed us that Ms Harema stayed in Dubai and could tell us more about it. This led to messages from which several quotes from Harema were extracted, as reproduced in the relevant passage of the article.”

A search for Loonstein led to a six-month-old report from another Dutch newspaper, NRC, which claimed that Loonstein, a lawyer, emigrated to Dubai after his legal company went bankrupt, leaving his clients, victims of fraud, worse off.

Contacted for comment, Loonstein confirmed that he knew Harema and had shared her contact details in “an app group” in relation to a flight from Muscat to Amsterdam. After this contact, Bellingcat sent him the photo of Harema to confirm her identity and asked him to share Harema’s contact details. In response, Loonstein refused to provide further comment. 

Merel Zoet and Claire Press contributed to this report.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

The post AI Used to Promote Non-Existent Evacuation Flights From the Middle East appeared first on bellingcat.

To stay up to date on our latest investigations, join Bellingcat’s WhatsApp channel here.

Bellingcat has geolocated footage of multiple Tomahawk cruise missiles travelling through Iraqi airspace towards Iran, either in violation of its airspace or with Iraq’s consent.

Bellingcat identified at least 20 individual cruise missiles and geolocated them over Iraqi Kurdistan including alongside Mount Piramagrun, in the Zagros Mountain range, and approximately 50 km southeast of the city of Kirkuk.

Modern Tomahawks can travel up to 1600 km, and are used for precision strikes. At the start of the war, the US had a carrier strike group in the Mediterranean and the Arabian Sea, as well as some independently deployed destroyers.

The US is the only participant in the war known to possess Tomahawks, which can be launched by ships or submarines. US President Donald Trump said at a press conference on Monday that Iran “also has some Tomahawks”. Official ​​government reports on Iran’s military balance don’t support this claim.

Considering the distance of US vessels to the geolocated missiles, the missiles seen in the videos were most likely fired from the Mediterranean Sea, Sam Lair, a research associate at the James Martin Center for Nonproliferation Studies, told Bellingcat.

Red Sea launches would be pushing the maximum range, and US Navy ships were not known to have been in the Persian Gulf at the start of the war, Lair said.

Brian Finucane, a senior adviser with the US Program at the International Crisis Group, told Bellingcat that without the consent of Iraq and Syria, the intrusion of Tomahawk missiles into their airspace “would violate its sovereignty and international law”. 

We asked the US State Department and Department of Defense as well as the foreign ministries of Iraq and Syria, if ​​the US had an agreement with Iraq or Syria to utilise their airspace for cruise missiles targeting a third country. The Department of Defense told Bellingcat they “had nothing to provide” while neither the Iraqi nor Syrian ministry had responded at the time of publication.

On Tuesday, Iraqi Prime Minister Mohammed Shia al-Sudani spoke with US Secretary of State Marco Rubio and stressed that Iraqi airspace and territory should not be used for any military action targeting neighbouring countries, the prime minister’s media office said.

Bellingcat geolocated at least eight videos showing Tomahawk missiles over Iraq. The videos show at least 20 individual Tomahawk missiles, based on the longest uninterrupted video we reviewed.

The below graphic shows all Tomahawk missiles Bellingcat has geolocated, which includes additional missiles identified outside of Iraq.

Click the arrows in the map below to view the verified missile sightings, including the original footage and geolocation analysis.

Interactive map showing the approximate locations of US carrier groups in the region at the start of the war, with a 1600 km range, in relation to Tomahawks geolocated by Bellingcat. We included a possible Red Sea launch point for visualisation, reference and comparison purposes only. The white arrows indicate the location of Tomahawk sightings. Their respective directions of travel are shown by default. All coordinates and directions shown are approximate. Source: Logan Williams/Bellingcat.

These missiles don’t always make it to their intended target. In addition to footage of the airborne missiles, Bellingcat also identified remnants of a Tomahawk missile that had crashed outside Kafr Zita in northwest Syria.

Missiles Fired From the Sea

On the first day of the war, Feb 28, the US Central Command (CENTCOM) published footage of Tomahawk missiles being fired from the sea. Later on March 1, CENTCOM released additional video of the USS Thomas Hudner (DDG-116) firing a Tomahawk missile, while operating in the Eastern Mediterranean Sea. 

According to a Center for Strategic and International Studies (CSIS) analysis, more than 160 Tomahawk missiles may have been used in the first 100 hours of the war, and “they would have been used to destroy Iranian air defenses and other counter-air capabilities and create permissive conditions for follow-on attacks”.

Arleigh Burke-class guided-missile destroyer USS Thomas Hudner (DDG 116) fires Tomahawk land attack missiles in support of Operation Epic Fury, Mar. 1, 2026. (U.S. Navy video)

Tomahawk Flights Through Iraqi Airspace

The footage analysed by Bellingcat showing cruise missiles travelling over land is consistent with the typical flight profile of Tomahawks, which cruise at low altitude along pre-programmed routes toward distant targets. 

Support Bellingcat

Your donations directly contribute to our ability to publish groundbreaking investigations and uncover wrongdoing around the world.

Donate

According to the US Navy, “Tomahawk cruise missiles are designed to fly at extremely low altitudes at high subsonic speeds, and are piloted over an evasive route by several mission tailored guidance systems.”

This explains why they are sometimes filmed by civilians during transit. Similar sightings have previously been recorded during US conflicts in the Middle East. 

Bellingcat analysed terrain features and solar data in the footage and confirmed the location and approximate direction of travel of the Tomahawk missiles. We found that they followed the terrain closely, and appeared to follow two different valleys near the Iraq-Iran border.

The Zagros mountain range stretches across much of Iran as well as northern Iraq. The mountains of this valley would provide details for the Tomahawks’ terrain matching guidance, and hide them from Iranian radar detection.

Click the arrows in the map below to view the verified missile sightings, including the original footage and geolocation analysis.

Interactive map showing the locations of Tomahawk sightings. The missiles were travelling through Iraqi airspace towards Iran in valleys near the Iraq-Iran border, and near Kirkuk. The respective directions of travel are shown (white arrows). All coordinates and directions shown are approximate. Source: Logan Williams/Bellingcat.

Other Geolocated Footage 

In a video filmed in Tehran and posted on the first day of the war, six Tomahawk missiles can be seen flying over the Qurkhane Bus Terminal in Tehran, as an anti-aircraft gun on a nearby building fires at them. Other gunfire can be heard in the distance.

Bellingcat previously geolocated a Tomahawk strike in Manib, Iran, near a school where 175 people, including children, were reported to have been killed.

A final video analysed by Bellingcat, posted on March 3, shows 13 Tomahawk missiles flying past a commercial ship in the direction of Iran, the M/V MAERSK BOSTON, while it was off the coast of Oman, according to solar, visual and Marine Traffic data.

New Tomahawk Variants

Since the beginning of the war, two new variants of Tomahawk missiles have been observed.

One Tomahawk variant seen publicly for the first time, distinguished by its visible black body, believed to be a stealth coating. Other missiles appear to have wings angled forwards, a modification designed to make them harder to detect by radar, according to an analysis by The War Zone.

Clobbering

Sam Lair, a research associate at the James Martin Center for Nonproliferation Studies, told Bellingcat that Tomahawks have GPS guidance and use terrain matching to determine their location. When there is an error in guidance, some missiles can “clobber” and hit the ground.

The US stopped firing Tomahawk missiles over Saudi Arabia during the 2003 Iraq War after some crashed in the country while attempting to strike targets. About ten Tomahawk missiles crashed during that war, with some landing in Iran and Turkey as well.

Bellingcat’s Logan Williams and Felix Matteo Lommerse contributed research to this article. Livio Spani, Anisa Shabir, Afton Briones, Mathis Noizet, and Nicole Kiess from Bellingcat’s Volunteer Community also contributed to this piece.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

The post Tracing Tomahawks: US Missiles Bound for Iran Spotted Over Iraq appeared first on bellingcat.

New video footage shows a US Tomahawk missile hitting an Islamic Revolutionary Guard Corps (IRGC) facility in Minab, Iran, on Feb 28, showing for the first time that the US struck the area.

The footage, released by Mehr News and geolocated by Bellingcat, also shows smoke already rising from the vicinity of the girls’ school where 175 people were reportedly killed, including children.

New video footage shows a US Tomahawk missile hitting an IRGC facility in Minab, Iran, on Feb 28, showing for the first time that the US struck the area. The footage also shows smoke already rising from the vicinity of the girls’ school, where 175 people were reportedly killed. pic.twitter.com/4jBXrNcRJO

— Trevor Ball (@Easybakeovensz) March 8, 2026

The footage would appear to contradict US President Donald Trump’s claim that it was an Iranian missile that hit the school.

The US is the only participant in the war that is known to have Tomahawk missiles. Israel is not known to have Tomahawk missiles.

The red cone superimposed over this image shows the estimated area of impact of the missile visible in the footage. The graphic also shows the position of a clinic, the school and other damaged buildings.

Planet Labs satellite imagery shows that only two structures within this red cone were damaged, including a clinic.

The other structure appears to be an earth-covered magazine or bunker.

Giancarlo Fiorella and Merel Zoet contributed research to this piece.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

The post Video Shows US Tomahawk Missile Strike Next to Girls’ School in Iran appeared first on bellingcat.

The Israeli Air Force (IAF) has dropped 5,000 bombs on Iran since the United States and Israel launched an attack last week, according to a statement by the IAF on March 4.

Bellingcat has monitored weapons used in the first few days of the war, and strikes across the region, including those that caused civilian harm. Some weapons, such as the US Precision Strike Missile, have seen their first use in combat. A variant of the Tomahawk missile, previously unknown to the public, was also used.

On March 3, the IAF posted three images in three separate posts showing a bomb not publicly seen in Israeli service before. The Israel Air Force released these photos accompanied with claims they were of jets participating in the strikes on Iran. Experts told Bellingcat that this bomb appears to have an incendiary component, and may be one intended to destroy chemical or biological warfare agents.

The images appear to show 2,000-pound-class air-delivered bombs fitted with Joint Direct Attack Munition (JDAM) guidance kit with a red band around the nose. Red is commonly used to denote an incendiary, while yellow indicates high explosive effect.

We identified key details about the munition and shared the images with two weapons experts.

Apparent Similarities to the MK 84

Dr N.R. Jenzen-Jones, the director of Armament Research Services (ARES), a weapons intelligence consulting company, told Bellingcat these images show a 2,000-pound-class air-delivered bomb fitted with a Joint Direct Attack Munition (JDAM) guidance kit.

Frederic Gras, an Explosive Remnants of War (ERW) expert, also told Bellingcat that the bomb could be of the US MK 80 series, or an Israeli copy, and has a JDAM guidance kit.

The US JDAM bomb guidance kit is designed for use with bombs that use the MK 80 series bomb bodies, and the closely related BLU-109 “bunker buster” body. 

The Open Source Munitions Portal added the munition to their website on March 3, describing it as “visually similar to a MK 84 general purpose aerial bomb”, while noting that “the marking scheme is distinctly different”. The War Zone also reported on these distinct markings, and possible munitions it could be.

“The combination of yellow and red bands probably indicates both a high explosive and incendiary payload, which would be consistent with a 2,000-pound-class bomb of MK 84 form factor known as the BLU-119/B Crash Prompt Agent Defeat (CrashPAD),” Dr Jenzen-Jones told Bellingcat.

Frederic Gras, an Explosive Remnants of War (ERW) expert said that the US and Israel both use red markings to indicate an incendiary payload, or effect. The bomb could be a full incendiary payload, with the yellow band indicating a bursting charge, or it could be a bomb primarily with a high explosive component, and a secondary incendiary effect, Gras added.

Red Bands on Israeli Weapons

It’s not the first time the Israeli Air Forces has published weapon images with red bands marking the warhead or payload section of a munition. Shortly after the start of the Gaza War in 2023, the IAF posted a photo which included an Apache attack helicopter with a Hellfire missile with a red band. The IAF deleted the post and replaced it with a similar photo of an Apache without this missile.

This fueled speculation online that this could be an incendiary or the thermobaric variant of the Hellfire missile, the AGM-114N. It has been approved by the US for sale to Israel.

M825A1 155mm white phosphorus artillery projectiles, munitions designed to create smoke, used by Israel also have a red band and a yellow band around the nose. 

Israeli munitions which are not incendiary have also been spotted with light red bands over the fuel tanks for munitions with jet engines, such as the Delilah cruise missile.

Designed To Target Chemical or Biological Weapon Stockpiles

The markings are consistent with the US-produced CrashPAD, but “given the possible CBW [chemical and biological warfare] threats Israel has long faced from Iran, it is entirely plausible that an Israeli analogue was developed,” Dr Jenzen-Jones told Bellingcat.

The CrashPAD contains white phosphorus and high explosives, and is designed to destroy biological and chemical warfare agents according to US government documents.

Dr Jenzen-Jones told Bellingcat that the CrashPAD is the only publicly known weapon of this type utilising a MK 84 bomb body although there are several programs producing similar munitions. A penetrating variant is known as the Shredder but it uses a modified BLU-109 bomb body, which is visually different from the MK 84 bomb body visible in the IAF photos.

CrashPAD has been in the US inventory for nearly two decades. “Chemical Agent Defeat weapons, such as Crashpad, are not illegal”, and they must undergo a legal review to ensure compliance with US domestic and international law, Michael Meier, former Senior Advisor to the Army Judge Advocate General for Law of War and current Adjunct Professor at Georgetown University Law Center, told Bellingcat.

“The express purpose for the reservation is that these weapons, such as Crashpad, are the only weapons that can effectively destroy certain targets such as biological weapons facilities, for which high heat would be required to eliminate bio-toxins,” Meier said.

Dr Arthur van Coller, Professor of International Humanitarian Law at the STADIO Higher Education, told Bellingcat that “if the CrashPAD is used as designed, i.e. to target chemical or biological weapon stockpiles sufficiently removed from civilian populations, then its use is consistent with IHL [International Humanitarian Law] and treaty law, even under CCW [Certain Conventional Weapons], Protocol III.”

Dr Arthur van Coller also said that the “United States and Israel are State Parties to the CCW itself,” but only the US is also a party to Protocol III on incendiary weapons, albeit with reservations, which means that Israel “is not legally bound by Protocol III’s restrictions on incendiary weapons (including those applying to CrashPAD) under treaty law”. Iran is not a party to the CCW at all.

The US is a major supplier of weapons to Israel, and has sent thousands of MK 80 series and BLU-109 bombs to the country. Israel also produces some MK 80 series bombs.

Israel and US Responses

The US Defense Security Cooperation Agency, which publishes details of some major arms sales, does not mention any transfers of the CrashPAD. Bellingcat asked the Department of State if the CrashPAD or weapons with similar capabilities were transferred to Israel. Bellingcat also asked the Department of State if they assessed that Iran had a chemical weapons program. A State Department Spokesperson told Bellingcat that “The Trump administration backs Israel’s right to self-defense” and referred Bellingcat to the IDF for questions about procurement and munitions used.

The US Department of Defense did not respond to requests for comment by the time of publication. 

Bellingcat asked the IDF what the bomb was, if it was supplied by the US, if it contained white phosphorus, thermobaric or fuel air explosives, and if the IDF assessed that Iran had a chemical weapons program. The IDF told Bellingcat that it “will not be able to provide details regarding the types of munitions it uses. With that said the IDF uses only legal weapons and ammunition.”

Bellingcat’s Carlos Gonzales contributed research to this article. Livio Spaini from Bellingcat’s Volunteer Community also contributed to this piece.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

The post The Incendiary Bomb Never Seen in Israel Before appeared first on bellingcat.

US President Donald Trump said on January 2 that the US was “locked and loaded and ready to go”. Trump was talking aloud about intervening in Iran if it continued a violent crackdown on demonstrators who had taken to the streets over spiralling inflation and ongoing repression. 

Thousands of Iranian’s were reported to have been killed by state security forces in just under a month. According to Amnesty International, the Islamic Revolutionary Guard Corps (IRGC), the Basij plainclothes militia, police forces and other plain-clothed agents carried out the deadliest violence against protesters in decades.

On Saturday, February 28, the United States and Israel launched a large-scale attack against Iran, killing Supreme Leader Ayatollah Ali Khamenei and targeting military infrastructure throughout the country. President Trump initially told Iranians they should seize control of the government but on Tuesday this week said: “If you’re going to go out and protest, don’t do it yet. It’s very dangerous out there. A lot of bombs are being dropped.” Almost 800 Iranians have been killed in US and Israeli strikes so far, according to the Iranian Red Crescent. 

While the US has released a list of military targets, including IRGC headquarters and missile systems, Bellingcat has reviewed strikes against another type of target inside the Islamic Republic — police stations.

Experts told the New York Times that strikes against these facilities may be part of an effort to motivate Iranians to challenge the regime, although satellite analysis alone doesn’t allow us to tell if it is the US, Israel or both nations who have targeted police stations.

Mapping Targeted Police Stations

Using medium-resolution PlanetScope satellite imagery from Planet Labs, Bellingcat has been able to locate at least 15 local police stations or similar buildings that were struck between March 1 and March 3. Videos and photos shared on social media also show the aftermath of some of these strikes.

Comparing the March 1 PlanetScope satellite imagery with imagery taken on March 3, it’s possible to make out visible signs of building destruction throughout Tehran. Some of these sites have already been widely-reported on, including the strike on Supreme Leader Ali Khamenei’s compound and official residence.

But Bellingcat reviewed damage to a number of smaller buildings throughout Tehran and cross-referenced the locations with data on Google Maps, Open Street Maps and Wikimapia where we found that several were listed as police stations. The majority of sites we identified are in dense urban areas. 

Video shared by Iranian state broadcaster Tasnim News showed the aftermath of a strike on what it describes as a “diplomatic police station” near Ferdowsi Square — one of downtown Tehran’s main intersections. Another video taken at the same location shows at least two people on the ground with a large amount of damage to nearby buildings. Geolocation of the videos puts them at 35.7032, 51.4189, adjacent to a school and office buildings. 

Another video, geolocated by a volunteer with Geoconfirmed — a volunteer geolocation collective — shows a heavily damaged police station near Tehran’s Grand Bazaar. PlanetScope imagery from March 3 shows heavy damage to the area around the police station.

Photos and video from the Golestan Palace, a UNESCO World Heritage Site that sits adjacent to the police office, shows that it also sustained damage.

Iran’s Police and Law Enforcement

Iran’s security apparatus includes a network of police, plain clothes officers, civilian militia battalions known as Basij and the Islamic Revolutionary Guard Corps. During recent protests security forces were seen shooting protestors on the streets, and many of those killed showed signs of being shot in the head.

Iran has experienced several waves of anti-regime protests over the past 15 years, all of which have been put down by the authorities who have not shied away from using extreme violence to contain them.

Although the Financial Times reported speaking to a Tehran resident that said one of the police stations we identified, in the Gisha neighborhood, had hosted a branch of Iran’s morality police, it is thus far unclear from the satellite data whether any of the police stations had any particular role during the recent protests.

Trevor Ball, Logan Williams and Felix Matteo Lommerse contributed reporting to this piece for Bellingcat. Anisa Shabir and Stéphanie Ladel contributed from Bellingcat’s Volunteer Community.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

The post Satellite Imagery Reveals Strikes on Iranian Police Stations appeared first on bellingcat.