The technological trajectory is clear: Hash-based systems anchored in the National Center for Missing and Exploited Children (“NCMEC”) database remain highly effective for identifying known CSAM, but they are structurally incapable of addressing synthetic, modified, or previously unseen material. Machine learning systems—trained on large corpora of images—offer the only plausible path forward for detecting novel..

The post Can AI Help “Solve” The Child Porn Problem? Magic 8 Ball Says, “Answer Hazy – Ask Again Later” appeared first on Security Boulevard.

Akamai researchers saw a 245% spike in cyberattacks in the first two weeks after the start of the U.S. and Israeli war against Iran as Iranian nation-state groups and independent hacktivists launch increasingly decentralized and destructive cyberattacks, which are expected to increase as long as the kinetic battle continues.

The post Cyberattacks Spike 245% in the Two Weeks After the Start of War With Iran appeared first on Security Boulevard.

The Middle East has entered a critical tipping point, as tensions between Iran, the United States, and Israel escalated into a complex hybrid conflict that blends traditional military operations with cyber and information warfare. The offensive, identified as Operation Epic Fury by the US and Operation Roaring Lion by Israel, demonstrates how modern hostilities can no longer be understood through conventional lenses alone.  Unlike previous confrontations, this campaign combined kinetic strikes, cyber intrusions, psychological operations, and information manipulation into a single, synchronized effort. Cyber capabilities were leveraged as a co-equal domain alongside air and missile strikes, revealing a new level of strategic integration that reshapes the dynamics of regional warfare.   Independent monitoring from Cyble Research and Intelligence Labs (CRIL) highlighted how these combined operations exposed both strengths and vulnerabilities among the actors involved. 

Strategic Build-Up and Diplomatic Limitations 

In the lead-up to the offensive, the United States mobilized its largest Middle East deployment since the 2003 Iraq invasion, positioning aircraft carriers, fighter squadrons, and intelligence assets near Iran’s borders.   Parallel diplomatic initiatives in Geneva offered a fleeting possibility of negotiation, as Tehran agreed to halt nuclear enrichment under IAEA oversight. However, mutual distrust, strategic imperatives, and long-standing hostilities rendered these measures ineffective, creating conditions ripe for Operation Epic Fury and Operation Roaring Lion.

Hybrid Warfare: The Cyber-Kinetic Nexus in the Middle East

The campaign’s defining feature was the integration of cyber operations with kinetic attacks. Iran’s domestic internet infrastructure was reportedly reduced to 1–4% functionality, as state media, government services, and military communications came under sustained digital assault. Popular services, mobile applications, and religious platforms were compromised, while government websites displayed defaced content intended to undermine Tehran’s official narratives.  Pre-existing cyber actors, including MuddyWater, APT42 (Charming Kitten), Prince of Persia/Infy, UNC6446, and CRESCENTHARVEST, amplified the conflict through phishing, data theft, and server exploitation. Simultaneously, psychological operations extended into Israel, delivering threatening messages about fuel shortages and national ID numbers.

Retaliation and Regional Cyber Convergence 

Iran’s response combined missile and drone attacks targeting Israel, Gulf Cooperation Council (GCC) states, and US military bases, causing civilian casualties and infrastructure damage, including at Dubai International Airport and an AWS cloud data center.   Hacktivist groups surged in parallel, with over 70 organizations conducting DDoS attacks, website defacements, and credential theft campaigns across multiple countries. Malicious payloads, such as a RedAlert APK mimicking Israel’s missile alert app, showcased tradecraft usually associated with state-sponsored operations.  Pro-Russian groups like NoName057(16) and Russian Legion opportunistically aligned with Iranian interests, while cybercriminal actors exploited chaos to launch ransomware and social engineering campaigns, demonstrating the convergence of ideological and financial motivations in modern hybrid warfare. 

Lessons and Implications 

The ongoing operations stress several key lessons for the region and global observers: cyber operations now function as coequal with kinetic action; hacktivist networks can act as force multipliers across borders; and opportunistic cybercrime thrives in environments of geopolitical uncertainty. Analysts emphasize the need for continuous vigilance, from credential monitoring and DDoS mitigation to proactive defense against emerging malware campaigns.  Operation Epic Fury and Operation Roaring Lion highlight that the current Middle East conflict extends far beyond conventional warfare. Even as Iran’s networks remain degraded, pre-positioned cyber capabilities and hacktivist activity could sustain prolonged disruption, signaling a persistent and modern threat landscape that will influence regional and global security calculations for months to come.

When the mysterious operator of an internet archiving-service decided to silence a curious Finnish blogger, they didn’t just send a stroppy email - they allegedly weaponised their own CAPTCHA page to launch a DDoS attack, threatened to invent an entirely new genre of AI porn, and tampered with parts of their own archive to smear the blogger's name. In this episode, we unravel how a website designed to preserve history may have trashed its own credibility - and how Wikipedia responded when trust went out the window. Plus a ransomware gang shoots itself in the foot with a classic case of buffoonery, accidentally corrupting the very keys victims would need to decrypt their data. When even the criminals can’t unlock your files, what happens next? All this, a surprisingly zen Pick of the Week, and a gloriously splenetic rant against web forms, on episode 456 of the award-winning "Smashing Security" podcast, with cybersecurity veteran and keynote speaker Graham Cluley and special guest Paul Ducklin.

To stay up to date on our latest investigations, join Bellingcat’s WhatsApp channel here

On the night of Jan. 7 this year, three 250-pound bombs smashed into an apartment block in the Al Tuffah neighbourhood of northern Gaza. Footage of the aftermath shows walls collapsed, rubble piled up and blackened household items scattered across the scene.

Although a ceasefire has been in effect since October, and a Board of Peace led by US President Donald Trump has been announced to begin phase two of that process, Israel has continued to conduct strikes within Gaza

The IDF claimed they targeted a senior Hamas operative in response to a violation of the ceasefire agreement in the Jan. 7 attack. 

Two people were reported to have been killed.

While the strike was an Israeli operation, among the debris were munition remnants of at least three US-made GBU-39 Small Diameter Bombs, including one that failed to explode.

American-made munitions like these have played a significant role in Israel’s operations in Gaza. 

The US has provided billions of dollars worth of military aid to Israel over the years, and has enacted legislation providing at least US$16.3 billion in direct military aid since the most recent war began. In the first few months of the Trump Administration nearly $12 billion in major weapon sales to Israel were approved with deliveries scheduled to take years to complete.

However, human rights groups like Amnesty International and Human Rights Watch have said that US-made weapons have been used in Gaza in ways that have likely violated international law. Multiple international media reports have also identified individual instances of civilian harm likely caused by US weaponry deployed by Israel in Gaza.

A 2024 State Department report, completed during the administration of former President Joe Biden, even stated that due to Israel’s “significant reliance on US-made defence articles it is reasonable to assess” that they have been used in “instances inconsistent with its IHL [International Humanitarian Law] obligations or with established best practices for mitigating civilian harm” — although Israel says it operates within international law and seeks to mitigate civilian harm while aiming to dismantle Hamas’ military capabilities. 

Yet the full extent of civilian harm in Gaza caused by the use of US-produced weapons remains unclear. 

Foreign media are not allowed into Gaza and the documentation of events there has relied heavily on social media footage and the work of local journalists, many of whom have been killed in Israeli air or ground strikes while carrying out their work.

Collating Incidents

Bellingcat has collated scores of incidents like the Jan. 7 strike in Al Tuffah where US-produced munitions have been found in the aftermath of Israeli strikes.

This analysis utilises publicly available media footage and identifies at least 79 specific cases, many of which caused death and damage to civilian infrastructure such as schools, homes and healthcare infrastructure.

While revealing, it is important to note that the data comes with some significant caveats and limitations that must be acknowledged before exploring it.

Gaza has been pummelled since the Hamas attacks of Oct. 7, 2023, when more than 1,200 Israelis were killed and hundreds more kidnapped. 

In response, Israel is reported to have deployed 30,000 munitions into Gaza in the first seven weeks of the conflict alone. The Israeli Airforce has also bombed over 100 different targets in Gaza in a single day multiple times.

This dataset – which details cases where US-made munition remnants have been found and evidence of their use published in media or posted to social media – therefore only captures a small fraction of the overall incidents over more than two years of war.

Furthermore, Israel and the US both produce some of the same munitions, such as the MK-80 series of bombs. The US supply of this series, especially the 2,000-pound MK-84 of which over 14,000 have reportedly been delivered since Oct. 7 2023, have been central to calls for the suspension of US arms transfers to Israel due to their destructive potential. 

But because Israel also makes these bombs domestically the country of origin cannot be definitively identified without specific remnants that show either the lot number, indicating the manufacturer, or other identifying information.

As a result a decision was made to try and track the use of three specific munitions that are made solely in the US and which Israel does not domestically produce. This, again, significantly reduced the number of incidents analysed. 

These munitions were Hellfire missiles, GBU-39 Small Diameter Bombs and Joint Direct Attack Munition (JDAM) bomb guidance kits. While this analysis does not track MK-80 series bombs, the JDAM kit is one of several guidance kits that can attach to bombs like the MK-84 but which is only produced by the US. 

The full dataset can be found here. The munition identifications were reviewed by Frederic Gras, an independent Explosive Remnants of War (ERW) Expert and Consultant.

Despite all of the above caveats and limitations, the analysis recorded 79 geolocated incidents where remnants of these three models of US-made munitions were either found in the aftermath of a strike or were captured in visual imagery in the moments before impact.

Beyond the 79 cases analysed and included in the dataset, other US-made munitions were identified in a further 26 cases, although it was not possible to geolocate the remnants or strikes prior to publication. It may be possible to geolocate the outstanding incidents in time. Bellingcat is, therefore, including these incidents in the dataset but notes further work is required for them. 

Many of the geolocations in the dataset were initially posted publicly by independent geolocators, or volunteers from the GeoConfirmed community, including Anno Nemo, Abu Location, fdov, Chris Osieck, Zvi Adler and Will Cobb. These geolocations were independently checked and verified by Bellingcat.

For the 79 incidents it was possible to geolocate, Bellingcat sought to compile reports of civilian harm. Yet given the lack of access afforded to international observers it was not possible to independently verify each of these reports of casualties or fatalities.

The reports, many of which cite health authorities in Gaza, detailed that at least 744 people were killed in these 79 strikes, including at least 78 women and 175 children. When reports offered a range for the number killed, or number of women and children killed, Bellingcat used the lower end of the estimate. 

Israel rarely provides estimates for civilian casualties from their strikes. It has also claimed that the Gaza Ministry of Health has exaggerated death tolls after specific strikes. Analysing previous public reporting of each incident in the dataset, Bellingcat found that the IDF had claimed at least 69 people that were reported killed in these attacks were militants belonging to Hamas or other factions. In one strike, where at least 33 people were reported killed, the IDF claimed to have targeted “dozens” of Hamas members, releasing the names of 17 people they said were part of Hamas. 

Bellingcat asked the IDF if they could provide a total for the number of people killed in the attacks listed in the dataset or for any specific strikes but they did not provide a figure. A spokesperson for the IDF provided information for eight strikes within the dataset that it said sought to hit “terrorist targets”. Bellingcat has noted this response beside each incident in the dataset.

The spokesperson added that Israel “strikes military targets and objectives in accordance with international law and takes all feasible measures to mitigate harm to civilians and civilian structures as much as possible.”

The Gaza Ministry of Health has reported that over 70,000 Palestinians have been killed in the conflict. While Israel has long disputed those casualty figures, Israeli media recently cited anonymous Israeli Defence Force (IDF) sources who said they believed them to be largely accurate. Israel has claimed to have killed about 25,000 militants in Gaza. 

Attacks on Schools

Attacks on schools, mosques, shelters and residences are all included in the dataset. In total, 28 strikes on schools using US made munitions were identified. GBU-39 bomb remnants were found at the site of 20 of these strikes. Most of these took place before the ceasefire of January 2025.

For example, the Khadija school in Deir Al Balah was targeted in three rounds of airstrikes on July 27, 2024 that used both GBU-39 bombs and MK-80 series bombs equipped with JDAM kits. Satellite imagery before and after the strike showed significant damage to the facility.

Video from the ground provided more detail, showing that the first round of airstrikes targeted five different areas of the school complex.

The unexploded bomb body of a GBU-39 was found inside the school, while the fuzewell from a GBU-39 bomb that exploded was photographed near the destroyed gate structure.

An evacuation notice was then reportedly issued, and two buildings on the eastern side of the complex were targeted with larger bombs, leveling the buildings there. An additional evacuation notice was reportedly issued before a third strike. 

A video of the third strike shows at least six people, including a child, visible within approximately 55 meters of where a bomb equipped with a US-made JDAM kit hit one of the already collapsed buildings on the eastern side of the complex.

These three strikes killed at least 30 people, including 15 children and eight women, according to reports collated by Airwars. At least 100 were injured, according to the same reports. Most people were reportedly harmed in the initial strikes, according to the UN Office of the High Commissioner for Human Rights.

The United Nations reported at the end of February 2025 that 403 of 564 school buildings in Gaza had been “directly hit” in some manner, either by airstrikes or by other munitions. School buildings are often used as shelters. However, Israel has claimed in some instances that they were being used as Hamas command centres.

After the war resumed in March 2025, recorded strikes on schools generally appeared to use Israeli-made munitions. Only two strikes on schools since then were found to have used US made munitions – a May 2025 attack on the Fahmy Al Jarjawi school with at least three US-made GBU-39 bombs that killed 36 people, according to hospitals in Gaza, and a July 2025 strike on Cairo Basic School where five people were reported killed and where remnants of a Hellfire missile was found.

While the dataset shows no other attacks on schools using US munitions after this period, it is important to note that there may have been other instances where US-made munitions were used in such circumstances but which were not recorded.

Strikes on Healthcare Facilities

Two strikes using US-made munitions to directly target medical facilities were identified in this analysis. A Hellfire missile was used in a June 2024 strike on a health clinic in Gaza City that killed Hani al-Jafarawi, the director of ambulance and emergency services in Gaza. However, the IDF claimed the strike had killed “the terrorist Muhammad Salah, who was responsible for projects and development in Hamas’ Weapons Manufacturing Headquarters”.

The Gaza Civil Defence Headquarters in Al Daraj, Gaza City, was also targeted with a US-made GBU-39 bomb in September 2024. The bomb penetrated multiple floors but failed to explode, causing injuries but no deaths.

Five instances of US-made munitions being used for strikes near medical facilities were also identified. Four of these strikes used Hellfire missiles to target tents within approximately 150 meters of the Al Aqsa Martyr’s Hospital Main Complex in Deir Al Balah.

The fifth strike used a US JDAM likely attached to a MK-82 500-pound bomb to target the Al Aqsa Mosque across the street from the hospital, approximately 50 meters away from the main hospital complex. This strike killed 26 people, according to the Gaza Ministry of Health. 

A US Marine Corps manual on Close Air Support states that a MK-82 bomb delivered within 425 meters is considered “danger close”, with a bomb delivered within 250 meters being 100 times more dangerous than the minimum “danger close” standard.

Evacuation Strike Notices

Twenty-six strikes were identified where US munitions were used to target buildings including homes, schools and mosques after an evacuation notice was issued by the IDF. In 23 of these strikes there was no reported harm. However, there was significant harm recorded in others even with evacuation notices. 

Evacuation notices are notifications that provide advance warning of strikes and can be made on social media or sent to people’s phones. These notices often provide journalists on the ground time to set up cameras to record the incoming strikes. Such videos are occasionally of high enough quality to identify the bomb guidance kit attached as JDAMs kit as they fall, as can be seen in the video below.

لحظة قصف مسجد الألباني في مدينة خانيونس بصاروخين من طيران الحربي .
The moment the Al-Albani Mosque in Khan Younis
was bombed with two missiles by warplanes.

: Abdallah Alattar / Anadoluimages
1 أغسطس 2025 pic.twitter.com/U3Tad0veA6

— عبدالله العطار abdallah alattar (@abdallahatar) August 1, 2025

By Sept. 17, 2025 Israel said it had destroyed 25 high-rise buildings in preparation for their assault on Gaza City. Bellingcat was able to identify that at least seven high-rise buildings in Gaza City, including Al Soussi Tower, Al Roya Tower, and Al Roya 2 Tower, were issued evacuation notices then destroyed using MK-80 series bombs with JDAM kits.

The Aybaki Mosque, built in the 13th century, was also hit with MK-80 series bombs with JDAM kit, which the IDF told Bellingcat was a strike targeting the “deputy commander of heavy machine guns unit in Hamas, Khaled Nabil Saleh Shabat”. The IDF has claimed that these tall buildings host Hamas infrastructure, including observation posts and prepared attack positions.

The public warnings posted by the IDF for buildings targeted in Gaza City in September 2025 alerted residents of specific blocks, as well as those in the target building and adjacent tents to leave and head south towards the IDF declared humanitarian zone.

Prior to strikes in Lebanon where the IDF issued evacuation notices, maps were publicly posted requesting civilians evacuate at least 500 meters away. However, a review of public posts by the IDF for evacuation notices in Gaza from September 2025 found no notices that provide a specific evacuation distance.

Bellingcat asked the IDF if the content of evacuation notices sent to people’s phones differ in content from those publicly posted and why evacuation notices in Gaza appeared to not provide a recommended evacuation distance like those issued by the IDF in Lebanon. The IDF told Bellingcat that they issue “clear and detailed advance warnings through multiple channels, including communications published by the IDF Arabic Spokesperson and enables the civilian population to evacuate before strike.”

The distance people are told to evacuate prior to strikes is important as fragments from bombs, or the buildings being targeted, can still kill or injure people hundreds of meters away.

In one strike where an evacuation notice was given before the strike, a four-year-old girl, Razan Hamdiye, was reported killed. One person was also reported killed in the strike on the AlRoya tower.

After the airstrike targeting the Harmony Tower, a graphic video captured by the Anadolu Agency showed a group of people about 120 meters away had been either killed or injured by the strike, despite the evacuation notice.

US-made munitions have also been used in other IDF strikes, including one which reportedly killed the leader of Hamas’ Military Wing, Mohammed Deif. At least 90 people were reported killed in this attack and US-made JDAM remnants recovered. US munitions were also used in the September 2025 strike that reportedly killed Hamas Spokesman, “Abu Obayda” and at least six other people, where remnants of US-made GBU-39 bombs were found.

American-made munitions were also used alongside other unidentified munitions in the June 2024 IDF hostage rescue operation in Nuseirat, where 274 people were reportedly killed. These 274 deaths are not included in the 744 people reported killed in the incidents contained within the dataset due to the inability to identify the other weapons used in at least 13 strikes that occurred during the operation.

Bellingcat reached out to the IDF, the US Department of State, and the US Department of Defense before publishing this story. Bellingcat also asked the primary contractors for these munitions, Boeing and Lockheed Martin, about whether they track how their products are used in Gaza.

Boeing, which manufactures the GBU-39 bomb and JDAM bomb guidance kit did not respond. Neither did Lockheed Martin, which makes the AGM-114 “Hellfire” missile.

The Department of Defense declined to comment.

A spokesperson for the US Department of State said “The US Government is not able to make such determinations” when asked how many civilian deaths could be attributed to the use of US-made weapons in Gaza. 

Bellingcat asked if the State Department held a different assessment than the NSM-20 which was introduced under President Biden and determined that it was reasonable to assess that US-made weapons were used by Israel in instances “inconsistent with its IHL obligations or with established best practices for mitigating civilian harm”. The spokesperson said “NSM-20 is no longer US policy.”

The State Department referred other questions about the use of the munitions highlighted in this article to the Israeli Defence Forces, who told Bellingcat that they do not detail the munitions they employ and that Hamas exploits “civilian infrastructure for terrorist purposes”.

---

Jake Godin and Carlos Gonzales contributed to this report.

Afton Briones, a member of Bellingcat’s Volunteer Community, contributed research to this piece.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here and Mastodon here.

The post Made in the USA: How American-Built Weapons Have Wrought Destruction in Gaza appeared first on bellingcat.

This investigation is part of a collaboration between Bellingcat and Evident Media. You can watch Evident’s video here.

The fatal shooting of Renee Nicole Good by Immigration and Customs Enforcement (ICE) agent Jonathan Ross in Minneapolis on Jan. 7 sparked nationwide protests, with often violent clashes breaking out between protesters and federal agents. Some of the most intense protests took place in Minneapolis itself, with an agent using a less-lethal launcher in ways that experts told Bellingcat were “punitive” and “questionable at best”.  

This agent, an elite Border Patrol officer who was masked but identifiable through the uniform number patch EZ-17, was captured on camera firing his B&T GL06 40mm less-lethal launcher at protesters five times in five minutes as he travelled down a street adjacent to where Good was killed.

While “less-lethal” weapons are not designed to kill, they can still result in serious injuries and even death when misused. In California, a protester said he was permanently blinded in one eye after he was shot with a less-lethal weapon at a protest on Jan. 13. Footage shows a DHS officer firing a PepperBall gun at his face at close range, causing him to bleed. 

Last year, a judge in Illinois ordered an injunction limiting federal agents’ use of force in the state due to what she described as aggressive use of force against peaceful protesters that “shocks the conscience”. However, Bellingcat found multiple examples of force and riot control weapons being used during immigration raids and in apparent violation of that order in the weeks immediately after.

Experts told Bellingcat that most of the less-lethal shots fired by EZ-17 after arriving at the site of Good’s shooting with Border Patrol Commander Gregory Bovino on Jan. 7, also appear to breach CBP’s use-of-force policy. 

Bellingcat analysed videos from news outlets and social media and mapped out all five shots the agent fired.

Four of these shots appeared to be aimed directly at protesters’ faces at close range, while a fifth was fired from a distance towards a crowd after tear gas had already been deployed. A sixth shot, captured at another location on the same day, also shows EZ-17 firing a shot from the same launcher at someone at head-level.

As of publication, DHS had not responded to Bellingcat’s requests for comment.

The Agent

In footage captured by independent news outlet Mercado Media, EZ-17 is seen inside the crime scene tape perimeter, standing near Bovino, with eight 40mm munitions on his belt. 

These included three sponge-nose impact rounds, which are designed for “pain compliance” through the direct force of impact, and five cylindrical munitions that can be filled with different payloads and chemical irritants. “BLAST” in blue text is visible on one munition, indicating a “Muzzle Blast” munition with a CS gas fill – commonly known as tear gas. At least three additional 40mm munitions are visible in his plate carrier. 

Another video by independent news network Status Coup News showed uninterrupted footage capturing five shots from the time the agent exited the crime scene perimeter (at 5:02) shortly before firing the first shot, to when he left in a truck with other agents (9:23) immediately after firing the fifth shot. 

The back of EZ-17’s vest shows that he belongs to CBP’s Border Patrol Tactical Unit (BORTAC). BORTAC is a specialised and highly trained unit that, according to the CBP, has a selection process “designed to mirror aspects of the US Special Operations Forces’ selection courses”. 

Members of BORTAC have regularly accompanied Bovino as he leads Trump’s immigration raids, including EZ-17 and EZ-2, another CBP agent that was frequently seen beside EZ-17 in the footage from Jan. 7. Both agents have continued to accompany Bovino on raids in Minnesota in subsequent days.

EZ-17 was also spotted alongside Bovino at an incident in Illinois, where a CBP agent in front of him appeared to shoot a protester at close range.

First Shot

In the Status Coup Media video, EZ-17, and three other CBP agents, including EZ-2, can be seen leaving the crime scene tape perimeter set up after Good’s death, pushing protesters who are physically blocking them. Snowballs are thrown at the CBP agents. 

EZ-17 and EZ-2 push a man to the ground who is blocking them. The video shows a clear view of his belt, and the eight munitions visible on his arrival at the scene are still loaded at this point.

EZ-17 initially aims at the man he had pushed to the ground, but then turns and aims at the face of another nearby protester who did not appear to be involved in any previous physical contact with the agents. As EZ-17 aims at the face of this protester, the man raises his arms to shield himself before EZ-17 fires. 

The large cloud of chemical irritant appears to disperse from the barrel immediately on firing for this shot as well as the next three shots EZ-17 fires.

This is consistent with the “Muzzle Blast” 40mm munitions produced by Defense Technology, which were seen in images of the agent’s belt.  Defense Technology says in its product specifications for 40mm “Muzzle Blast” munitions that these rounds provide “instantaneous emission” of a chemical agent in the immediate area (30 feet) of the person shooting them. 

Second Shot

Seconds later, after EZ-17 is hit by a snowball, he turns and fires towards the face of a man who is filming in the direction the snowball came from. It is unclear if this man is the intended target or someone else in the crowd behind him. 

Third Shot

The third shot is at a man who was seen on video throwing a snowball that hits EZ-2.

EZ-17 and EZ-2 chase this man, with EZ-2 spraying him in the face with Oleoresin Capsicum (OC) spray, also known as pepper spray or mace. EZ-2, when leaving the perimeter, can be seen carrying a Vexor Professional-branded canister.

Vexor exclusively produces various types of OC spray, and does not list any chemical irritant sprays that do not contain OC on its website. 

The man slowly walks closer to the agents, saying that he has been maced. EZ-17 pushes the man, then aims at the man’s face and fires. 

The seals that keep the chemical irritant inside the 40mm canister before it is fired can be seen hitting the man in this shot, with the smoke surrounding his face.

Fourth Shot

After the third shot, an unmarked white CBP truck turns off the street and tries to drive down an alley. Protestors begin physically blocking the vehicle, throwing snowballs and other objects at it. The windshield gets cracked, and the back window gets broken. EZ-17 and EZ-2 physically push the protesters blocking the truck out of the way, with EZ-2 also deploying what appears to be a canister of OC spray.

A person begins banging on the windows of the truck, and EZ-17 rushes around the truck to fire his launcher towards this person’s face.

University of St. Thomas School of Law professor Rachel Moran, who reviewed the videos at Bellingcat’s request, said that of the six shots we identified as being fired by EZ-17 this one appeared to be “the most reasonably related to carrying out the duty of helping the vehicle evacuate” as the person targeted was “still pounding aggressively” on the vehicle when EZ-17 fired the shot.

Fifth Shot

After EZ-17’s fourth shot, EZ-2 deploys a tear gas grenade, and the CBP truck moves down the alley, away from protesters. 

EZ-17 can be seen reloading next to EZ-2, who is holding a canister that appears to be OC spray, and another CBP agent holding a PepperBall gun.

The CBP agent with the PepperBall gun appears to cross over to the other side of the truck, and EZ-2 appears to begin to enter the vehicle. 

As soon as the back right door on the truck closes, gas from the muzzle can be seen from where EZ-17 was standing. 

This fifth shot appears to be “skip-fired” or aimed towards the ground before ricocheting upwards, at close range, resulting in three visible projectiles going towards the crowd of people, narrowly missing some. 

Although the footage is blurry with the tear gas from the grenade EZ-2 threw still clouding the air, EZ-17 appears to be the only agent who could have fired this: EZ-2 was not armed with a projectile launcher, and PepperBall guns like the one carried by the other CBP agent do not have munitions that release multiple projectiles with a single shot.

Chemical irritant smoke was seen being released by the projectiles from this last shot as it travelled through the air. 

The multiple projectiles are consistent with the 40mm “SKAT Shell” by Defense Technology, which ejects four separate submunitions upon firing, each dispensing chemical irritants. In one of the videos, a SKAT Shell is seen in EZ-17’s belt.

Roosevelt High School

In another video from the same day, EZ-17 was filmed again alongside Bovino when CBP showed up at Roosevelt High School in Minneapolis at dismissal time. 

This video showed EZ-17 again firing his B&T GL06, apparently towards someone’s head, this time someone who threw a snowball at a CBP agent. 

‘Punitive and Unlawful’

Patrick Wilcken, Amnesty International’s Researcher on Military, Security and Policing issues, said that while the overall situation shown in the videos was tense, with “verbal abuse, some shoving/throwing of snowballs and the attempted obstruction of a vehicle”, there did not seem to be any substantial physical threat to the agents that would have justified the use of less-lethal weapons. 

Wilcken, who reviewed the videos of all six shots fired by EZ-17 at Bellingcat’s request, said the actions of agents shown in these videos – pursuing fleeing protesters and in some instances firing at protesters who appeared to be trying to protect themselves – were “punitive and unlawful”. 

CBP’s use-of-force policy states that weapons such as 40mm launchers are only authorised for use against subjects offering “active” or “assaultive” resistance. Similarly, DHS’ use-of-force policy guidance says agents may use force “only when no reasonably effective, safe and feasible alternative appears to exist”, and may only use the level of force “objectively reasonable in light of the facts and circumstances” that they face at the time force is applied.

“Officers should only resort to less lethal weapons when faced by a serious physical violence posing a threat to themselves or others that is not possible to diffuse in any other way,” Wilcken said. “They must exercise force with restraint, to the minimum extent possible while respecting and enabling the right to peaceful assembly.”

University of St. Thomas School of Law professor Rachel Moran agreed that whether the use of less-lethal weapons is justified largely depends on the level of threat or aggression the agent faces from the person targeted. Although she said the fourth shot could be justified in helping the CBP vehicle evacuate, Moran said the justification for the other shots was “questionable at best” based on the footage. 

For example, Moran noted that although the man in the third shot had thrown a snowball at another officer, any threat had dissipated by the time EZ-17 shot him because the man had already run away and clearly had his hands up with nothing in them. “The shot appears to be more retaliatory than defensive”, she said. 

Similarly, for the incident at Roosevelt High School, Moran noted that EZ-17 did not appear to be in any danger from the snowball, as the person who threw it was already retreating before the agent fired.

Moran said that if EZ-17 was carrying a B&T GL06 40mm launcher, he did appear to violate CBP policy by directly aiming at people’s faces.

B&T GL-06 by 草泥马小逼崽子 on Sketchfab

CBP’s use-of-force policy states that agents using munitions launchers, including 40mm launchers “shall not intentionally target the head, neck, groin, spine, or female breast”. However, Bellingcat’s analysis of the six shots fired by EZ-17 showed that he appeared to be aiming at the head of targets in five of these cases. 

Travis Norton, a retired police lieutenant and use-of-force consultant, told Bellingcat that standard training and manufacturer guidance for 40mm launchers recommended aiming at “large muscle groups of the lower body” while avoiding “prohibited target areas” like the head, neck, chest, spine and groin. This helps to reduce the risk of significant injury, Norton said. 

Norton said that 40mm launchers are not intended for random or area fire: “Their use is limited to clearly identified individuals who are engaging in violent or dangerous behaviour and cannot be safely addressed by other means.”

Although he declined to comment on specific incidents based solely on video footage, Norton said that skip-firing – which was used in the fifth shot identified by Bellingcat, and the only shot where a person did not appear to be targeted at head-level – was generally not a standard or recommended practice in most law-enforcement training programs. 

“Because ground conditions, angles, and projectile behaviour are unpredictable, skip-firing reduces accuracy and control and increases the risk of unintended injury,” Norton said. 

---

Pooja Chaudhuri contributed research to this piece.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here and Mastodon here.

The post Five Shots in Five Minutes: Analysing One Federal Agent’s Use of Less-Lethal Launcher in Minneapolis appeared first on bellingcat.

To stay up to date on our latest investigations, join Bellingcat’s new WhatsApp channel here.

This investigation is part of a collaboration between Bellingcat and Evident. You can watch Evident’s video here.

Children in Chicago’s Old Irving Park neighbourhood were preparing for a Halloween parade on Oct. 25 when federal agents reportedly deployed tear gas on the street to disperse protesters opposing immigration-related arrests in the neighbourhood.

“Those kids were tear gassed on their way to celebrate Halloween in their local school parking lot,” US District Judge Sara Ellis said in court on Tuesday, according to a CBS News report. “I can only imagine how terrified they were.” 

Ellis was questioning US Customs and Border Patrol Commander Gregory Bovino over this and other incidents that protesters allege violate a temporary restraining order (TRO) she issued earlier this month. 

The Oct. 9 TRO was issued after a group of journalists, faith leaders and protesters filed a lawsuit against the Trump administration over what they described as a “pattern of extreme brutality” by federal agents against peaceful protesters since Operation Midway Blitz – a multi-agency operation against “criminal illegal aliens” in Illinois – began on Sept. 2. 

When Judge Ellis asked Bovino to produce all use-of-force reports since Sept. 2 from agents involved in Operation Midway Blitz by the end of Tuesday, Bovino said it would be impossible because of the “sheer amount”. Ellis then ordered Bovino to turn over these reports, along with the accompanying body camera footage, by the end of Friday, Oct. 31.

The court order places restrictions on federal agents’ crowd-control measures within the state, including their use of “riot control weapons” such as tear gas and pepper spray, the use of force against individuals and requiring people to leave public spaces that they lawfully have the right to be in. 

A subsequent court filing on Oct. 27 alleges that federal agents have violated the TRO “almost every day” since it was issued. “Immigration enforcement does not typically require the daily use of tear gas on civilians in residential areas,” the filing stated.

Bellingcat’s analysis of social media videos from 28 events in Illinois from Oct. 9 to Oct. 27 found multiple examples of force and riot control weapons being used.

In total, we found seven that appeared to show the use of riot control weapons when there was seemingly no apparent immediate threat by protesters and no audible warnings given. Nineteen showed use of force, such as tackling people to the ground when they were not visibly resisting. Another seven showed agents ordering or threatening people to leave public places. Some of the events identified showed incidents that appeared to fall into more than one of these categories. 

You can view the full dataset here. 

View this post on Instagram

A post shared by Evident Media (@evidentmediaorg)

It is important to note that the full context of an incident may be unclear from videos on social media alone. Bystanders often only begin filming when an arrest is already ongoing, for example, which can make it difficult to determine what happened in the moments before force was applied. Each of the events included in our dataset were verified to have taken place in Illinois in recent weeks with at least two sources – videos taken by different people, local reporting or statements from the Department of Homeland Security (DHS).

The DHS – which oversees Customs and Border Patrol (CBP) as well as the United States Immigration and Customs Enforcement (ICE) – has justified the use of force or riot control weapons by saying that protesters were threatening or attacking agents. 

Bellingcat asked DHS whether it had any response to the TRO or allegations that agents had violated the TRO.

In a response received after the publication of this piece, Assistant Secretary Tricia McLaughlin did not directly address the TRO but said DHS officers “only use crowd control methods as a last resort when repeated warnings have been given”. 

DHS also said, several times in its response, that its officers were “facing a 1,000 percent increase in assaults against them”. This is a claim that the department has previously made when commenting on clashes with protesters during immigration operations in other cities such as Los Angeles and Portland. However, an NPR analysis of court records earlier this month only showed about a 25 percent rise in charges for assault against federal officers through mid-September, compared with the same period a year ago.

The TRO does say that riot control weapons or force may be deployed in circumstances such as where there is an “immediate threat” of physical harm to the agents or others, multiple warnings have been given, or where “necessary and proportional” for an arrest. We did not include videos where it was obvious that such conditions had been met. 

Despite the limitations, videos taken by eyewitnesses are often the only evidence of such incidents, which may not be reported by media or may have concluded by the time journalists reach the scene.

Riot Control Weapons

In our analysis, we found videos showing the use of riot control weapons such as tear gas, pepper spray and other less-lethal weapons in seven events where protesters appeared to be posing no visible threat in the footage, and where no audible warnings appeared to be given. 

Among its provisions, the TRO prohibits the use of these types of weapons on people “who are not posing an immediate threat to the safety of a law enforcement officer or others” and also in cases where using them on intended targets would result in injury to those who aren’t posing any threat. 

One of these videos captured the moment Bovino threw what looked like a tear gas canister during the Oct. 23 clashes in the Little Village neighbourhood, during an operation where eight people were arrested, including a 16-year-old US citizen. Bovino and DHS have said that he was hit on the head by objects thrown by protesters before he threw the tear gas canister.  

DHS posted a video on Facebook, claiming that it was evidence that “the use of chemical munitions was conducted in full accordance with CBP policy and was necessary to ensure the safety of both law enforcement and the public”. 

The video showed a rock skidding on the ground behind Bovino, but did not show the moment that it allegedly hit the Border Patrol chief on the head. A protester who filmed the encounter has reportedly disputed that Bovino was hit. 

Tear gas was also deployed on Oct. 12 in Albany Park, Oct. 14 in the East Side of Chicago, Oct. 24 in Lakeview and Oct. 25 in Avondale. Bellingcat reviewed footage of each of these incidents and could not see threats to the agents’ safety in the videos before tear gas was deployed, or that audible warnings were issued within the footage.

Videos we reviewed also showed other types of riot-control weapons mentioned in the TRO. Another video from the Oct. 23 protests in Little Village, posted by a protester named Enrique Bahena, shows an agent shooting a less-lethal projectile directly at the person filming. An Oct. 26 court filing said Bahena was shot in the “neck from five feet away with a pepper ball”. 

Bellingcat’s analysis of the video, which appears to be the same one shown in screengrabs in the court filing, found that the video in fact shows the agent deploying a B&T GL-06 40mm launcher, which can be used to launch chemical irritant rounds such as the one visible in the video.  

Bahena said in an interview with local outlet Chicago Block Club that agents did not give warnings before they shot him “in the throat” and threw gas canisters at the group of protesters who were shouting at them to leave. He also said in the interview that protesters did throw objects at agents, but that this was after agents had already used force.

B&T technical specifications for their 40mm projectiles state that “shots to the head, neck, spine, or heart are to be avoided unless lethal force is justified”, and advise users to aim at the waistline. 

A DHS Office of Inspector General Report in 2021 states that “ICE’s use of force policy indicates that the 40MM launcher is deadly force when fired at someone, while the CBP use of force policy only directs officers not to target a person’s head or neck”.

During this same event in Little Village, videos show other officers appearing to fire less-lethal weapons towards protestors.

The TRO restricts the use of Compressed Air Launchers or Munitions Launchers such as 40mm launchers to strike a person, including on the neck, unless they pose an “immediate threat of causing serious bodily injury or death”.  

In another incident on Oct. 22, an agent appeared to quickly roll down a window and spray what appeared to be a chemical irritant at protesters who were confronting federal officers near a Sam’s Club store in the Cicero neighbourhood of Chicago. 

The incident was captured in two separate livestreams, which show a few protesters near an unmarked dark grey Chevrolet Tahoe with no front licence plate. One of the protesters taps on the window of the vehicle. Someone then rolls down the window and sprays what appears to be a liquid very quickly before rolling the window back up as the car leaves the scene. One of the people filming said in the post for the livestream that this was pepper spray, although Bellingcat was unable to verify this. 

DHS did not respond directly to Bellingcat’s questions about whether it believed that the use of riot-control weapons – including during the Oct. 23 Little Village protests – was justified based on the terms of the TRO. 

Use of Force

Bellingcat also reviewed multiple videos of agents using force in arrests that appeared to be related to Operation Midway Blitz, and identified those where the force shown being used looked potentially excessive and the person being arrested did not appear to pose an “immediate threat of physical harm to others” – a requirement in the TRO for using force such as tackling or shoving someone to the ground.

On Oct. 10, a day after the TRO was issued, an ICE agent was seen dragging a teenage girl out of a car in Hoffman Estates, a suburb of Chicago, and tackling her to the ground while she shouted “I’m not resisting”. The teenager, reportedly an 18-year-old US citizen, was handcuffed and an officer appeared to put a knee on her back. DHS Assistant Secretary McLaughlin said in a post that the incident was a “burglary” arrest from 2024 which did not involve ICE – although this has been debunked by multiple news outlets. 

Bellingcat asked DHS about this specific incident and why McLaughlin’s post remains up on X despite multiple news outlets verifying that the incident took place this month in Hoffman Estates, but did not receive a response. 

This was not the only case where DHS’ version of events appears to contradict video footage of the incident posted on social media. 

On Oct. 22, a woman identified by DHS as Isabel Mata was arrested by Border Patrol agents in Little Village. A video of the incident shows multiple agents tackling her while one of them has his knee on her back to hold her to the ground. DHS stated Mata “allegedly threatened a law enforcement officer after stating she would put a hit out on Chief Gregory Bovino”. Bellingcat reviewed a video that showed the minutes before Mata was tackled by agents but did not hear any threat being made, even though Mata appeared to have been standing near the person filming.

DHS initially did not respond to Bellingcat’s questions about this incident, but after publication it sent us the same statement it made on Oct. 24 with the allegation that Mata had threatened Bovino.

Another video from Oct. 10 appears to show agents colliding with a car on Hubbard Street and dragging the driver out by her legs. The woman, identified as Dayanne Figueroa, told Newsweek that she was on her way to get coffee before work and “instead of handling the situation as a routine traffic incident”, masked armed agents forcibly removed her without questions or informing that she was under arrest.

DHS reportedly told Newsweek that Border Patrol was making a targeted arrest when Figueroa’s vehicle blocked agents and struck an unmarked government vehicle. They also said she “violently resisted” and was arrested for assault on a federal agent.

The video shows agents arresting someone, before one of their vehicles swerves into another lane and appears to hit Figueroa’s car. Multiple bystanders can be heard shouting that the agents hit Figueroa’s car first and that they were making a U-turn in the middle of the street.

Bellingcat asked DHS about the conditions under which it would consider the use of force – such as tackling or shoving people to the ground – proportionate and necessary, but did not receive a direct response to this question. 

Dispersal Orders

The TRO prohibits federal agents from “issuing a crowd dispersal order requiring any person to leave a public place that they lawfully have a right to be, unless dispersal is justified by exigent circumstances as defined by Department of Homeland Security Use of Force Policy”. 

Bellingcat has asked DHS about when agents are justified in telling people to get off the streets, or people in cars to stop following them, and whether there are any laws preventing people from following or filming federal agents from a distance. DHS did not respond to these questions in their response after this story was published.

However, we found several examples of agents telling people to leave public places when they did not appear to be impeding arrests in video footage. 

In a video recorded in Chicago’s Arlington Heights on Oct. 24, a masked man with a rifle tells someone filming to “get the f*** across the street” and “get back to your car”. The person filming is shouting that agents have assaulted a woman and slapped her phone out of her hands, and the video appears to show a woman in a scuffle with a masked agent. A separate video from the same location and date shows agents arresting a man who is on the ground. 

In some of these cases, agents appear to be pointing non-lethal weapons at civilians while ordering them to leave public spaces. A video from Oct. 16 shows agents telling protesters to “get out of the street”, pointing pepper spray at them and threatening them with arrest in Chicago’s Evanston neighbourhood.

A similar incident took place in Rolling Meadows on Oct. 19 when an officer was pictured pointing a pepper ball gun from a moving vehicle at a person filming him in a parking lot. A federal judge reportedly said the incident was “troubling” and has called for answers. 

On Oct. 20, in Berwyn, an agent pointed a gun at a woman who said she was pregnant. By the woman’s account, the agents were chasing after two people and the video shows her honking to alert those nearby. A DHS agent told Newsweek that the agent “acted to protect his life and safety of others around him and showed great restraint”.

Judge Ellis’ TRO is set to expire on Nov. 6. There is a scheduled hearing the day prior, Nov. 5, to determine if the TRO should be converted into a preliminary injunction. 

---

Editor’s Note (Oct. 31): This story was updated to include a response by the Department of Homeland Security who responded to our request for comment after publication.

Pooja Chaudhuri, Kolina Koltai, Youri van der Weide, Sebastian Vandermeersch, Melissa Zhu and Trevor Ball contributed research to this piece, alongside Fraser Crichton, Olivia Gresham, Bonny Albo and Vladimir Zaha from Bellingcat’s Global Authentication Project.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Twitter here and Mastodon here.

The post ‘Pattern of Extreme Brutality’: Tear Gas, Pepper Balls Among Weapons Deployed Against Protesters in Illinois appeared first on bellingcat.

Four masked men in police tactical vests surround a young scooter rider, cuffing his hands behind his back. One person, whose face is fully obscured with a cap, sunglasses and a balaclava, is heard on eyewitness video telling the scooter rider: “You came into this country as a J1, as an exchange student. You didn’t show up … You lied, ok?” 

“Yeah, he’s illegal, either way,” another person is heard saying, before they lead him to an unmarked car. 

Nearby, two Metropolitan Police Department (MPD) cars are seen blocking part of the lane. Uniformed MPD officers stand around the area, neither intervening nor appearing to participate directly in the arrest. 

The video was posted by Will Allen-DuPraw, whose profile says that he is a photographer and videographer based in DC, on Sept. 2. Allen-DuPraw wrote in the post that bystanders reported that authorities were stopping Latino men on scooters along Florida Avenue Northwest, a major road in Washington DC, and had arrested two. 

An urgent alert sent out on the morning of the same day by Stop ICE Alerts, a community-driven alert network for those affected by Immigration and Customs Enforcement (ICE) raids, reported similar information. The alert said that ICE, Homeland Security Investigations (HSI) – a branch of ICE focused on investigating transnational crime – and MPD were “stopping Latinos on scooters” and had arrested one or two people along Florida Avenue Northwest. 

With US President Donald Trump’s crackdown on immigration, scenes of federal agents detaining people while accusing them of immigration offences have been cropping up all over social media from around the country. An analysis of ICE arrest data by DC-based think tank Cato Institute found that in June and July alone, ICE conducted almost 9,000 street arrests nationwide of immigrants who had no criminal convictions, charges, or removal orders. About 90 percent of these were immigrants from Latin America.

The incident on Florida Avenue Northwest was one of 42 that Bellingcat and our partner Evident Media geolocated and verified using videos and photos from social media and news reports. These showed federal agent encounters in the capital, in the month or so since Trump’s federal takeover of DC on August 11. The full dataset can be downloaded here.

In the three weeks after DC was placed under federal control, Trump’s administration said more than 300 people without legal immigration status were arrested in the District. 

Like previous immigration raids that we documented in Los Angeles, the federal agents involved in the DC cases were often masked and in military wear. Some wore generic “Police” vests, while others had attire indicating specific government entities such as ICE and HSI. The vehicles they used were usually unmarked, with plates from a variety of US states.

There is one key difference, however. In LA, a state law prohibits local law enforcement from using its resources for immigration enforcement in most cases. But in DC, where no such law applies, MPD has frequently been seen working with federal officers since the federal takeover last month. 

In half of the incidents in our dataset, local DC law enforcement could be seen working alongside federal agents. Most of the DC local police were from MPD, though some were from the Metro Transit Police Department. Aside from ICE and HSI, agents from federal agencies including the US Park Police, Federal Bureau of Investigation (FBI), Drug Enforcement Administration (DEA) and Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) were also seen in the videos.

“We are definitely seeing MPD cooperate at a level we’ve never seen before, and it is resulting in people getting arrested and sent to detention,” Michael Lukens, who runs immigrant rights centre Amica, told Evident Media.

MPD has not replied to Evident Media’s queries about their cooperation with federal law enforcement agencies as of publication.

Of the cases we analysed, 22 involved the arrest of delivery drivers or tradespeople, such as workers in an air conditioning and heating truck.

In two widely shared videos, DC resident Tyler DeSue claimed agents pulled over his Uber Eats driver for having “incorrect tags” on his bike, then checked his registration and insurance and saw it was valid. DeSue said they then asked for his immigration status and detained him.

The videos DeSue posted did not show the initial encounter between the agents and the driver, but did show the arrest. DeSue can be heard in one video telling agents that the man they were questioning did not understand what they were saying, and they should use Google Translate. Another witness is heard calling the arrest “ridiculous” and questioning if the agents have “better things to do than to harass Uber Eats drivers”. 

In a second video, also posted by DeSue, agents are seen wrapping the man in chains before putting him in an unmarked car. 

Another video posted by NPR reporter Chiara Eisner on Aug. 21 shows an agent in a “Police” tactical vest handcuffing a man in front of a truck, with US Park Police nearby. When Eisner asks what is happening, a Park Police officer says this is a traffic enforcement because the man was driving a commercial vehicle on park roads. 

Evident Media asked the Department of Homeland Security (DHS) about videos of these two specific incidents, as well as whether federal agents were using race or language as factors in their stops and arrests. In response, a DHS spokesperson said: 

“What makes someone a target for immigration enforcement is if they are illegally in the US – NOT their skin colour, race or ethnicity. America’s brave men and women are removing murderers, MS-13 gang members, pedophiles, rapists – truly the worst of the worst from our communities.”

The spokesperson also claimed that the men detained in these two incidents were undocumented immigrants who entered the country illegally. They did not mention any other criminal record for the men or comment on why the men were stopped by local police in the first place. 

Lukens told Evident Media that ICE agents had been seen in areas with larger immigrant populations, such as Columbia Heights and Adams Morgan, which he described as “high-level racial profiling”.

Constitutionally, the Fourth Amendment protects anyone in the US, regardless of immigration status, from unreasonable searches and seizures by the government. 

“If you are an ICE officer and the only thing that you have to fall on or to fall back on in justifying arrest is a person’s racial makeup and what vehicle they are driving, then you have conducted an illegal stop and an illegal arrest,” Lukens said. 

---

Melissa Zhu, Eoghan Macguire, Pooja Chaudhuri and Kolina Koltai from Bellingcat, as well as Vladimir Zaha, Fraser Crichton and Bonny Albo from Bellingcat’s Global Authentication Project, contributed research to this piece.

From Evident Media, Jennifer Smart, Kevin Clancy and Zach Toombs contributed to research and production for the video report.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here and Mastodon here.

The post Trump’s Takeover of DC: Traffic Stops Turn Into Immigration Arrests for Delivery Riders and Workers appeared first on bellingcat.

Armed and masked men leaping out of unmarked vehicles. Latino men taken from their places of work or while waiting for the bus. Street vendors roughly tackled to the ground and forcefully held down. 

Since early June, the streets of Los Angeles have borne witness to frequent and aggressive immigration raids that have seen people suspected of being undocumented migrants detained. Some have been rapidly deported.

Between June 6 and June 22 alone, the Department of Homeland Security (DHS) reportedly arrested 1,618 people for deportation from LA and the surrounding areas of Southern California. This averages out at about 95 people a day, and arrests and deportations have continued in the period since. 

Those numbers represent an increase over the months prior and appear to be in line with reports of apparent White House directives to up immigration-related arrests.

Bellingcat worked with our partners at Evident Media and CalMatters to gather and document social media and online footage of as many of the LA raids as possible.

We collected videos of just over 100 incidents starting on June 6, picking out sightings and what appear to be recurring trends and tactics used by officers. A full list of the incidents can be seen and downloaded here.

The footage shows officers from agencies including US Customs and Border Protection (CBP) and Immigration and Customs Enforcement (ICE), which operate under DHS, arresting people in public spaces, in places of work and outside residences. In some cases, it was unclear what agency officers were with due to a lack of clear identification.

In others, officers can be seen using significant force to detain people. In most cases officers keep their faces covered, concealing their identity. Unmarked vehicles were also used on numerous occasions. 

The raids bear similarities to incidents previously investigated by Bellingcat, CalMatters and Evident Media in California. Earlier this year, agents from the El Centro Border Patrol Sector travelled over 300 miles from the US southern border to the city of Bakersfield to take part in what they said were targeted raids to apprehend immigrants with “criminal records”. 

However, just how targeted that mission was became a point of significant tension, with rights and labour groups claiming it was anything but. Of 78 people arrested, only one had been flagged for prior removal. 

In April, a federal judge issued a preliminary injunction in the wake of the Bakersfield raids barring Border Patrol from conducting warrantless raids in California’s Eastern District, stating that “you just can’t walk up to people with brown skin and say, ‘Give me your papers.’”

The American Civil Liberties Union (ACLU) and other industry and rights groups last week requested a similar injunction be put in place in California’s Central District, which includes Los Angeles. 

The head of the El Centro unit, Gregory Bovino, is now in charge of the operations across Los Angeles. Agents from his El Centro Border Patrol unit have also appeared in videos of raids in LA neighbourhoods seen by Bellingcat. Bovino even appeared at a raid involving hundreds of officers in LA’s MacArthur Park on July 7.

To be clear, it is not possible to know exactly what transpired in every incident captured in our dataset. The vast majority of videos only offer snapshots of what occurred as most raids relied on the element of surprise. Witnesses, therefore, often did not appear to start recording until raids were under way. Similarly, many of the raids captured were in public spaces such as in parking lots or at strip malls. Others did occur at private residences, but incidents are more likely to be captured in places where more members of the general public are likely to be present, such as on busy thoroughfares. This is likely reflected in the data. 

Judging by the number of people detained in LA over the last few weeks, the videos also only capture a portion of all the incidents that have actually taken place. Despite that, the available videos suggest a few trends that may offer clues as to the tactics being deployed by agents across the city. 

From Pasadena to Long Beach, and from Playa Vista to Baldwin Park, incidents have been recorded across LA. Some have even stretched beyond Los Angeles County, with raids recorded in Oxnard, Santa Ana and Fontana.  

With billions in new funding heading for ICE operations in the near future, some believe what has happened in Los Angeles could be just the start of an even bigger immigration crackdown across the US. President Donald Trump also appeared to suggest as much in a June 16 Truth Social post, stating that he wanted to expand detention and deportation efforts to other cities like Chicago and New York.

Raids at Work

A striking number of videos showed people being arrested at what appeared to be their places of work. These included arrests at car washes, food stands and swap meets.

In one incident on June 22 at Bubble Bath Hand Car Wash in Torrance, numerous agents can be seen swarming the facility and approaching blue-shirted employees. One bystander told local broadcaster ABC7 Eyewitness News that she was able to stop the arrest of an employee by advising him not to answer questions. However, others were roughly handled by agents, some of whom appeared to be wearing ballistic armour and carrying guns.

Emmanuel Karim, the manager of Bubble Bath Hand Car Wash – who can be seen in the video angrily remonstrating with agents asking them “what are you doing here?” – told Bellingcat in a phone call that  officers did not provide warrants or identification. 

He had previously told the media that two of his workers were taken during the raid.

In total, our dataset documented 12 raids that appeared to specifically target car washes, including one that hit the same car wash twice. Industry group CLEAN Carwash Worker Center, however, has documented a much higher number. As of July 4, they told Bellingcat they had information detailing raids in at least 55 carwash locations, with some experiencing multiple raids over the month of June. CLEAN said they had documented at least 96 arrests, including of both carwash workers and customers.

Another video from June 8 in Westchester showed a street vendor wrestled to the ground and surrounded by agents near his stall with their weapons drawn. 

In another case on June 22, street food vendor Celina Ramirez clung to a tree as federal officers pulled up and arrested her outside a Home Depot in the Ladera Heights neighbourhood. A bystander told ABC7 Eyewitness News that officers did not provide identification as to who they were, nor did they provide a warrant. While some wore Border Patrol identification, there were also plain clothes officers. All appeared to be masked.

The nature of such arrests has led some to claim that officers are racially profiling workers they may pass at the likes of street food stalls while also targeting businesses they assume will have a high proportion of Latino workers, such as car washes. 

The ACLU lawsuit describes a “systematic pattern” where “individuals with brown skin are approached or pulled aside by unidentified federal agents, suddenly and with a show of force, and made to answer questions about who they are and where they are from”. 

Such practices, where agents do not identify themselves or explain why an individual is being arrested are “contrary to federal law”, the ACLU lawsuit states.

Bellingcat asked DHS about the claims within the ACLU lawsuit as well as incidents at car washes and with the street vendors in Westchester and Ladera Heights. DHS did not comment specifically on the Westchester and Ladera Heights incidents. They also did not respond to the owner’s claims that agents did not provide a warrant or identification when they raided the Bubble Bath Hand Car Wash in Torrance. 

But in an email sent after this article was initially published DHS Assistant Secretary, Tricia McLaughlin, responded to details in the ACLU lawsuit, stating that: “DHS targets have nothing to do with an individuals’ skin colour. What makes someone a target is if they are in the United States illegally. These types of disgusting smears are designed to demonise and villainise our brave ICE law enforcement. ”.

McLaughlin added: “DHS enforcement operations are highly targeted, and officers do their due diligence. We know who we are targeting ahead of time. If and when we do encounter individuals subject to arrest, our law enforcement is trained to ask a series of well-determined questions to determine status and removability.”

Strip Malls and Home Depot Parking Lots

On June 16, a video of a bystander questioning two ICE agents handcuffing and arresting a man in LA county’s Hacienda Heights was shared online. The man said his name is Leo Torres and when the bystander questioned whether the agents had a warrant for his arrest they replied: “This is a public place, we don’t need a warrant.”

Torres was picked up outside an area that appears to be a strip mall. Our dataset showed 25 incidents at such facilities. But raids were captured on video most regularly near outlets of one brand in particular. 

In total, incidents were recorded outside or close to 17 different Home Depots – a common place for day labourers to pick up materials for their work or to pick up work itself.

For example, in a video captured on June 19 an agent in a Border Patrol uniform can be seen chasing a man in the parking lot of a Home Depot in Burbank. 

In another incident on June 22, a man was pinned to the ground in a Home Depot parking lot in Gardena. Signs displaying prices of items for sale can be seen at the start of the video that match the font used at Home Depot locations.

In another incident on June 9, video footage uploaded from multiple angles showed officers running after and questioning a man near a Home Depot in Huntington Park. The footage also showed other officers chasing others who were nearby.

While it was not possible to identify the vast majority of the people detained in the videos gathered, the raids at Home Depots bear a striking similarity to the Bakersfield operation conducted by El Centro Border Patrol earlier this year. 

Back then, eight of just over 50 videos gathered by Bellingcat, Evident and CalMatters appeared to take place in Home Depot parking lots.  

Bellingcat asked DHS if agents had been targeting Home Depots without necessarily having warrants for people they expected to encounter there but did not receive a direct response on this question.

Masked and Unmarked

Identifying who or, indeed, what agency is carrying out a particular raid in the videos collected is not a simple task. Many agents wear masks or keep facial features covered, concealing their identity.

Because it is often unclear who these agents are, many videos show bystanders asking agents for identification, a warrant, a badge number or who they are with. In one video on June 23 at a Home Depot in Inglewood, an officer is asked for his badge number by a bystander who is filming a man being taken away. The officer briefly flashes his badge before dashing into the back of a car that speeds away.

Similarly, officers can be seen wearing plain clothes instead of uniforms in many videos, thus making it difficult to ascertain which agency they belong to.

Some have warned that the heavy use of masks and shielding of identity makes it easier for fraudsters or imposters to pretend to be federal officers or law enforcement to commit crimes. There have already been a number of cases where this has happened in the last month, including in Philadelphia, New York and Los Angeles. However, acting ICE Director, Ted Lyons, has said officers are covering their identity to protect themselves and their families from harassment.

A new bill being proposed called the “No Secret Police Act” would require local, state, and federal officers from covering their faces during operations in California. 

Unmarked vehicles are also regularly seen being used by arresting officers in videos. Bellingcat was able to identify several instances where the same unmarked cars appeared in separate videos in different parts of the city. The cars were identifiable by their number plates. 

Other vehicles being used by officers, including Border Patrol vehicles that bear individual identifying numbers, could also be seen in multiple videos.

In an emailed response to questions sent after this article was initially published, a DHS spokesperson said: “When our heroic law enforcement officers conduct operations, they clearly identify themselves as law enforcement while wearing masks to protect themselves from being targeted by highly sophisticated gangs like Tren de Aragua and MS-13, criminal rings, murderers, and rapists.”

Use of Force and Intimidation

Several videos in the dataset appear to show significant force being used by agents.

A number of incidents featured heavily armed or aggressive officers. Agents can be seen carrying rifles, handguns, and wearing military wear, from camouflage uniforms to helmets and ballistic vests.

One notable instance was the June 16 raid at the Sante Fe Springs Swap Meet that reportedly saw dozens of agents, many of whom were heavily armed, raid a popular swap meet where families were in attendance. Border Patrol filmed this raid and posted a video on their Instagram account. The video shows a number of officers carrying weapons, wearing protective gear, preparing for the raid and walking through the swap meet. A sign which reads “Family Fun Live Music Shopping” can be seen in the video. The raid reportedly resulted in the arrest of two individuals. Businesses there have since complained that the raids have put people off from coming back.

In another incident on June 29, video footage showed the arrest of two men on a street in Santa Ana. Agents appeared to use batons on both men as they lay on the ground. An eye witness stated that agents used pepper spray after one of the men was already on the floor. Federal officials later told local news outlet, KTLA, that one of the arrested men was a Mexican national present in the US illegally, although they did not detail how officers first engaged with the two men or if they were individuals known to law enforcement. The same officials also said to KTLA that officers were attacked by “a violent mob” protesting the detainments before all suspects were arrested. 

Other incidents showed officers pointing guns at a man trying to escape in a car and another who was trying to take a photo of a federal agent’s licence plate. One man could be seen with blood pouring from his head after officers smashed his car window and dragged him from his vehicle in another incident captured in the dataset.

On June 24, during an ICE raid in the Fashion District in Los Angeles, agents from multiple agencies were seen tackling a man, Luis Hipolito, pushing him on top of a curb. A video shows one officer put an arm around his neck as multiple agents pile on top of him and appear to punch the back of his legs. Moments later, he begins convulsing on the ground. 

Hipolito is a US citizen and was apparently filming the arrests of street vendors in the area. As reported by the LA Times, officers ordered Hipolito to leave the scene. When he did not, an officer sprayed him in the face with a substance, the LA Times reported. Video shows Hipoloito swinging his arm in response but it is not clear in the video if his hand connected with the officer. He is being charged with assault for allegedly punching an agent before he was tackled and wrestled to the ground. Hipolito’s family has since said that he did not intentionally touch the agent and that he had been blinded by what they said was pepper spray to his face. They said it was a natural reaction to being unable to see after being pepper sprayed. The LA Times reported that DHS Assistant Secretary Tricia McLaughlin had said the actions of Hipolito and another US citizen had “kept ICE law enforcement from arresting the target illegal alien of their operation.”

There have been numerous reports of US citizens being detained by ICE. In one June 12 incident, a video showed a US citizen being chased and detained by Border Patrol before being eventually let go. Before leaving, however, one of the officers asks: “Why did you run?”

While it is not clear if the only reason they sought to detain this individual was because he ran, that would seem to align with a promotional video published on the Customs and Border Protection YouTube page where an officer can be heard saying, “If they run, we go”.

In response to questions from Bellingcat about whether force used by officers was always proportional or if there were instances where any had gone too far, DHS responded after this article was initially published. McLaughlin said that agents are trained to “use the minimum amount of force necessary to resolve the situation in a manner that prioritises the safety of the public and our officers”. 

She added: “Resisting arrest places those being arrested, the agents, and the community at risk. Law enforcement is now facing a nearly 700 percent increase in assaults while carrying out enforcement operations. But this will not deter [Customs and Border Protection] – we will continue enforcing the law and protecting American communities.”

---

This article was updated on Wednesday July 9, 2025, to include responses from the Department of Homeland Security which were received after initial publication time.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here and Mastodon here.

The post Masked, Armed and Forceful: Finding Patterns in Los Angeles Immigration Raids appeared first on bellingcat.

Content warning: This story discusses non-consensual deepfake nude imagery.

On the surface, Crushmate appeared to be one of many artificial intelligence “girlfriend” or “companion” apps. Its multiple websites said it specialised in “crafting the AI girl of your dreams”, and on Google and Apple’s app stores, it was described as an “AI chat product designed to provide users with a comprehensive emotional support and communication experience”. 

But ads linked to the app on popular social media platforms showed it was offering an entirely different service – making nonconsensual nude images of real women.

Meta announced last week that it was suing Joy Timeline HK Limited (“Joy Timeline”), the Hong Kong-based company it said was behind a group of deepfake “nudifying” apps under “CrushAI”, which include Crushmate. This was following a 404 Media report in January that CrushAI had bought thousands of ads on Instagram and Facebook, using multiple fake Facebook profiles to evade Meta’s moderators. 

However, a Bellingcat investigation has uncovered two additional companies in Hong Kong and mainland China – Soul friendship HK Limited (“Soul friendship”) and Wuhan Ruisen Zhuoxin Network Technology Co., Ltd (“Wuhan Ruisen”) – that appear to have links to these apps. 

The CrushAI ads showed women, including celebrities and influencers, having their clothes artificially removed using deepfake technology. They led to pages prompting users to upload photos of people and “erase clothes” off them. 

404 Media’s report prompted Illinois Senator Dick Durbin to write to Meta CEO Mark Zuckerberg about CrushAI’s advertising on Meta’s platforms, in a letter pointing out that “the generation and dissemination of nonconsensual, deepfake intimate imagery are acts of abuse and violations of privacy that inflict lasting harm on victims”. 

Asked about the two other companies Bellingcat has linked to CrushAI, Meta said it was looking into them and would take action, including legal action, as necessary if it found violations of its policies. The company also said they will continue to take the necessary steps against other advertisers who abuse their platform.

Soul friendship was the listed developer of Crushmate on the Apple App Store, while Wuhan Ruisen filed an application for a US federal trademark related to the Crushmate brand last year. Documents supporting Wuhan Ruisen’s trademark application suggest that the app earned more than US$45,000 in subscriptions between December 2023 and July last year. 

The legal filing, which Meta provided to Bellingcat, shows that the social media giant is seeking an injunction to prevent Joy Timeline from placing ads related to nudify apps on its platforms. It is also claiming US$289,200 in damages, including costs it said it incurred for investigating and removing ads for the CrushAI apps, to respond to public and regulators’ queries in relation to the ads and to take enforcement action against Joy Timeline.

The complaint stated that Joy Timeline placed over 87,000 violating ads on Facebook and Instagram as of February this year, mainly targeting users in the US, Canada, Australia, Germany and the UK.

In response to Bellingcat’s queries, a Crushmate representative said that the app had permanently shut down but had “very briefly relied on the support of many third-party partners” in the early stages of its business. 

On the relationship between CrushAI and Joy Timeline as well as the two other companies the representative said that “since the project has now ended and the team no longer exists, I’m unfortunately unable to verify whether the company you mentioned in your email was one of our former partners”. 

Soul friendship, Joy Timeline and Wuhan Ruisen did not respond to multiple requests for comment on their relationships with each other or with CrushAI.

Joy Timeline

Like other notorious AI nudify apps, CrushAI appears to own multiple websites with the same domain name (“crushmate”) but different extensions such as .site .net .vip and .us. Bellingcat found at least 23 domains that used the Crushmate name, all of which are no longer accessible. These were mostly registered on two days in April and July 2024. We also found other sites with identical homepage layouts and content to Crushmate, with similar domains like “Crushai”, “crushh”, “crrru”, “crushx” and “crush1”. 

Using Domain Tools, we were able to link these sites – and more – through an identical Google Analytics Tag, which is used to track website traffic.

While nearly every one of these websites had their WHOIS registration info redacted for privacy, one was not, and it was registered to Joy Timeline.

Our search on Whoxy, a reverse WHOIS search tool, found 158 domains registered publicly to Joy Timeline at the time of publication. Only one carried the Crushmate name, but 28 more had almost identical layouts and also appeared to be deepfake “nudify” apps. 

For example, archived versions of the main pages of two of these domains, “sparkaifun [dot] online” and “chatnplay [dot] online”, were identical to the home page and “clothing eraser” pages on CrushAI’s sites.

It is possible that there are more similar web domains that did not show up in our searches, as domain registrants can also choose to redact their information. Other active domains owned by Joy Timeline, according to publicly accessible domain information, include homepages for other “AI chat” apps, photo editing apps and mobile games, among others.

On Hong Kong’s Companies Registry, Joy Timeline’s director was listed as a person called Zhang Xiao, who holds a Chinese passport. 

The company was registered with 100 shares issued at a total value of HK$100 (US$12.80). Zhang Xiao was listed in the company documents as owning 90 of these shares, while another Chinese national, Zhang Shiwei, owns 10. 

Zhang Shiwei is the director of Soul friendship, which Bellingcat’s investigation has also linked to the CrushAI apps. 

Soul friendship

Although Crushmate is no longer available on Google’s Play Store and Apple’s App Store, archived versions of its app listings on both of these stores led us to Soul friendship, another Hong Kong-based company.

Crushmate’s developer on Google’s Play Store from September 2024, based on a cached version of the page, was listed as “LipLip Team”. Our online searches of LipLip Team showed that it had another app listed on the Play Store called “LipLip – Live Video Chat&Meet”, which appeared to be a chatting app. 

Bellingcat could not find any company called “LipLip Team” registered in Hong Kong, where LipLip-Chat’s archived X bio stated that the app is based. 

But the URL of LipLip’s page from the developer’s archived Google Play Store profile, based on both indexed copies of the Google Play Store listing and LipLip’s X bio, included the ID “hk.soulfriendship.chat” – our first clue that another company was involved. 

On the Google Play Store, the app ID which makes up part of the URL is based on the package name of an app, which uniquely identifies the app across the Play Store. The package name could be set to anything, as long as it is not used by any other app on the Play Store. 

However, in this case, it happens to closely match the name of Soul friendship, the Hong Kong-based developer that published both Crushmate and LipLip-Chat on the Apple App Store.

We were able to find more information on Soul friendship by viewing LipLip-Chat’s Apple App Store listing as it would appear from a country within the European Union. 

Due to the EU’s Digital Services Act, Apple is legally required to verify and display more detailed information for traders distributing apps in the EU than in other jurisdictions. 

This includes developers’ Data Universal Numbering System (DUNS) number – a nine-digit number key for uniquely identifying companies worldwide – as well as contact information such as their address, phone number and email address. 

Even from outside of the EU, it is easy to view this information by tweaking the country code in the URL of the web-based App Store listing. 

For example, the developer information visible on the US app store listing for LipLip-Chat only shows Soul friendship’s name. But simply changing the country code from “us” to “nl” (the Netherlands’ country code) reveals the company’s DUNS Number, address, phone number and email address:

The address listed for Soul friendship, in the commercial district of Wan Chai, Hong Kong, is the same one on Joy Timeline’s domain name registration records. This address is also listed as belonging to one of the 6,900 or so Trust or Company Service Providers (TCSPs) in Hong Kong which are authorised to provide, among other corporate services, a registered business or office address.

Documents from the Companies Registry in Hong Kong show that Zhang Shiwei is Soul friendship’s listed director.

Although they have different names and directors, Soul friendship’s and Joy Timeline’s shareholders are the same and there are multiple overlaps in how the two companies operate. 

Like Joy Timeline, Soul friendship was registered with 100 shares issued at a total value of HK$100. In a mirror of the arrangement for Joy Timeline, Zhang Shiwei, the director of Soul friendship, owns 90 of Soul friendship’s shares while Zhang Xiao, the director of Joy Timeline, owns 10 shares. 

In addition to their common TCSP-linked address in Wan Chai, both companies used the same registered office address in Kwun Tong, an industrial and business area in Hong Kong, on their business filings. This is the address of another TCSP, which serves as the company secretary for both of these businesses.

Searches for Soul friendship and Joy Timeline online did not turn up much, except websites under their names that used identical templates. Neither website mentioned Crushmate or CrushAI, and both said on their “About Us” page that they were founded in 2022 and provided “IT consulting and software development services”. 

Wuhan Ruisen Zhuoxin Network Technology 

To complicate things even further, Bellingcat found two US federal trademark applications filed for Crushmate by a mainland Chinese company, Wuhan Ruisen, in August 2024. The first application, in the category of “Advertising, Business, and Retail Services”, was rejected on the grounds that the company did not provide sufficient evidence of using the Crushmate mark in commerce. 

The second one, in “Computer and Software Products and Electrical and Scientific Products”, was officially registered with the trademark office on April 29, 2025. The documents filed for federal trademark applications are publicly accessible through the United States Patent and Trademark Office (USPTO)’s website. 

In their trademark applications, Wuhan Ruisen provided “specimens”, which are samples of how their trademark is used in commerce. These included screenshots of both Crushmate’s Google Play Store and Apple App Store listings – showing LipLip team and Soul friendship HK as the app developers – as well as screenshots of their website. 

John Halski, a US-based lawyer whose practice focuses on trademark and copyright, told Bellingcat that it is possible for a company to include samples or specimens in their trademark application from a different company through a third party licence. 

However, Halski said that whether multiple company names in an application would be questioned depended on the examiner.

“The [trademark] examiner has the discretion to ask: ‘You sent me this specimen showing that party XYZ is using it and you claim that your name is ABC’. Then they may ask, ‘is this under a licence arrangement?’”

Anyone may file an application for a trademark, whether or not they own it, but other parties may oppose the application – such as if they are claiming to be the original owners of the trademark – within 30 days after it is published. Wuhan Ruisen’s application for the Crushmate trademark was published on March 11 this year, and successfully registered without opposition on April 29.

The application documents included a screenshot that appeared to show a Stripe payment dashboard, with 4,563 successful payments. All of the visible payments were for US$9.99, which was the weekly cost of a VIP subscription to Crushmate on the US site at the time the application was submitted. 

Assuming the only payments recorded by the dashboard were for these subscriptions, this would imply that by the time of the application being submitted in August last year, Crushmate had earned at least US$45,584.37 in subscriptions. It is unclear what the exact timeframe captured by the screenshot of this dashboard was, although the application states that the first use of the trademark was Dec. 25, 2023. 

Another screengrab included in the application, also apparently from Crushmate’s Stripe dashboard, showed a breakdown of the locations of Crushmate’s paying customers. This view on Stripe’s dashboard displays the “tax thresholds” for each state in the US and shows whether the income generated has reached taxable status. The screengrab indicated that Crushmate had paying customers across the US, with the most transactions from Kentucky and Utah. 

Based on documents from China’s official business registry which match the company’s name in Chinese and address, Wuhan Ruisen was established in March 2021 with a registered capital of 10 million Chinese yuan (US$1.38 million). 

We are not naming the legal representative of Wuhan Ruisen, listed in these documents, as the exact relationship between this company and CrushAI is still unclear. The legal representative’s name does not appear on Soul friendship or Joy Timeline’s business registration records in Hong Kong. 

A search for the company’s name on China’s Internet Content Provider licence database shows that it registered for five different domain names. Only one was accessible as of June. This site, which describes the Wuhan company as a “professional software development company” focusing on the development of desktop and mobile software, lists a number of apps supposedly developed by the company. None of the CrushAI apps were among them.

Some of the apps on this page have a close resemblance to software by foreign developers. For example, the first app on the page is an AI translator called “DeepL”, which is also the name of an AI translation app by a German startup that does not currently offer paid plans in mainland China. 

On third-party consumer service platform Heimao Tousu, there were more than 40 complaints between October 2023 and March 2025 about the company. Most said they paid between 29 and 69 yuan (US$4 to US$9.50) to download software they believed to be genuine, only to discover the products were fake or did not work. When they asked for refunds, they were ignored.

Wuhan Ruisen did not respond to multiple emails requesting for comment, and when we called the phone number listed on its website, we got an automated message stating that the number dialled was invalid.

Taking It Down

Crushmate’s X profile and a US domain site carrying its name was accessible until April. That same month, the US Take It Down Act, which criminalises the distribution of non-consensual deepfake pornography at the federal level, passed. It was signed into law in May, and Crushmate’s X profile was deleted sometime that month. 

At time of publication, all 23 of the Crushmate domains, the additional nudify-related domains owned by Joy Timeline, and the other CrushAI domains appear to be either offline or display an “under maintenance” notice after users register and log in. 

When Bellingcat reached out to a support email listed on several Crushmate websites, an unnamed individual responded. 

This person said the decision to shut down operations and disband the team actually took place “several months” before the introduction of the Take It Down Act.

“Since then, this inbox has remained inactive,” they said. 

The person emailing us did not explain why they were replying from an inactive account, or respond to subsequent questions about who they were or what their role in Crushmate or CrushAI was.

Joy Timeline has purchased domains as recently as May 14, but none of these appear to be nudify sites or currently hosting content.

---

Featured image credit: Reihaneh Golpayegani / Telling Tales / Licensed by CC-BY 4.0

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here and Mastodon here.

The post Meta’s Suit Against Hong Kong Firm Was Just the Beginning – More Companies Linked to CrushAI ‘Nudify’ Apps appeared first on bellingcat.