Bellingcat has identified at least 80 police stations or infrastructure related to law enforcement agencies and the Basij paramilitary group that has been damaged or destroyed in the first three weeks of the United States and Israel’s war against Iran. Experts told Bellingcat that both countries aim to degrade the Iranian regime’s “repressive capacity”.

Combined, the US and Israel have conducted thousands of strikes during the course of the 2026 war in Iran. Targets range from Islamic Revolutionary Guard Corps (IRGC) sites, Navy vessels to Iranian weapons manufacturers.

In early March, a Bellingcat analysis using satellite imagery and available photos and videos identified police stations as another apparent target, with at least 15 damaged or destroyed in the capital, Tehran.

We also identified multiple strikes against police infrastructure in the country’s north and west; these areas were targeted by the Israel Defence Forces according to a map released by the IDF on March 31.

“We are providing the brave people of Iran with the conditions to take their destiny into their own hands,” declared the Israeli Ministry of Foreign Affairs official X account, along with a photo of a destroyed police station.

اینجا کلانتری ۱۲۱ سلیمانیه در خیابان نبرد تهران بود.

ما شرایطی را برای مردم شجاع ایران فراهم می‌کنیم تا سرنوشت خود را در دست بگیرند. pic.twitter.com/VSm6YVvIwZ

— اسرائیل به فارسی (@IsraelPersian) March 5, 2026

In all, the majority of strikes Bellingcat analysed focused on police stations (30 incidents) and command centers or headquarters (29 incidents). Locations also include sites related to Basij, a plainclothes paramilitary organisation (9) affiliated with the IRGC that were “involved in the deadly crackdown” of protests in January 2026, others are associated with special forces (3) and traffic (2) or diplomatic (2) police compounds.

Due to commercial satellite companies limiting access to imagery over Iran and neighbouring countries we relied on Sentinel-2 imagery data to help verify the incidents, as well as videos and photos, some of which were also verified by independent geolocators and contributors to the Geoconfirmed volunteer community and confirmed by Bellingcat researchers. 

Location data was partly determined using open source mapping data either from Wikimapia, OpenStreetMap or Google Maps. When video footage or photos were available for incidents reportedly targeting police stations, the location was verified with geolocation and satellite imagery analysis using either Planet Labs medium resolution PlanetScope data (restricted to imagery collected by March 9) or low resolution Sentinel-2 data.

Some locations were discovered utilising location data taken from OpenStreetMap using Overpass Turbo and comparing that with available Sentinel-2 data throughout Iran.

Map showing geolocated incidents in Iran. Click the markers to view the coordinates, sources, and verification notes. Map: Bellingcat/Miguel Ramalho

A Problem of Scale

Israel has released multiple videos showing the targeting of bases and checkpoints belonging to the Basij. In mid-March, the IDF announced the killing of the paramilitary group’s commander, Gholamreza Soleimani. 

Targeting the Basij is part of Israel’s and the US’ agenda “to degrade the regime’s repressive capacity,” Ali Vaez, the director of International Crisis Group Iran Project, told Bellingcat. Police stations are “not involved in repression in the way that crowd control police or Basij centers are”, so targeting them “appears more aimed at preventing the Islamic Republic from being able to maintain control internally,” he said.

Vaez told Bellingcat that, when considered alongside the broader range of targets, including industrial factories, the widespread targeting of police stations is part of a strategy “to make Iran ungovernable for the existing regime or whatever comes after”. 

Vaez was skeptical about the short term effects: “It’s a problem of scale. Iran is such a large country, even if you are able to completely destroy, not just degrade, the capacity of the regime in policing, oppressing, etc – it really requires not just maybe weeks but maybe months if not years.”

The Risk of Civilian Casualties

As of April 7, the Iranian Human Rights Activists News Agency estimates there’ve been more than 1,700 civilian fatalities during the war. 

Several police stations are situated in densely populated urban areas such as Tehran. Stations are used by civilians for various reasons including renewing driving licences, so if these buildings are targeted “during working hours and not in the middle of the night then risk is higher for these people,” Vaez said.

Map showing geolocated incidents in Tehran. Click the markers to view the coordinates, sources, and verification notes. Map: Bellingcat/Miguel Ramalho

A recent joint Airwars, Center for Civilians in Conflict and Human Rights Activists in Iran report detailing the first month of civilian casualties included a section on the worsening situation for detainees in Iranian prisons — including police stations that have been targeted. 

“I was detained in the holding cell of [Police Station 148] for ten days, along with four other activists. Now it looks like nothing is left of that station but ruins. I can’t even recognize where the detention area was. I keep wondering what happened to the people who were being held there during the attack. – Activist, told HRA upon seeing photos of the police station after recent US/Israeli airstrikes.”

Footage shared and geolocated by the BBC’s Shayan Sardarizadeh showed Police Station 148 damaged after an apparent strike in mid-March.

The main building of Tehran’s 148 police station and its courtyard, located on Enghelab Street, has been severely damaged in air strikes conducted on Friday.

The adjacent Hamoon Theatre also sustained some damage.

Video: @Vahid

Location: 35.700812, 51.402163@GeoConfirmed pic.twitter.com/9sdOtHd2XN

— Shayan Sardarizadeh (@Shayan86) March 14, 2026

One destroyed police station identified by Bellingcat in the city of Mahabad in northwestern Iran led to apparent damage to an Iranian Red Crescent Society building located next door. According to Iran’s Tasnim News agency (an IRGC-affiliated media outlet sanctioned by the EU, the US and Canada), one Red Crescent employee was injured in the attack.

The police station adjacent to the Red Crescent building isn’t identified on any mapping services, though there are reports “Police Station 11” was targeted the same day.

Israel has also targeted checkpoints operated by Basij members.

Bellingcat examined two cases showing Israeli strikes on checkpoints while civilians were passing. In one video, a strike hits a checkpoint as five motorbikes and a vehicle go by.

In another IDF video, a yellow bus is immediately adjacent to the checkpoint when it is hit. It is unclear how many people were on the bus at the time of the strike or if anyone was injured.

According to the Open Source Munitions Portal (OSMP), Israeli drones commonly employ the Mikholit bomb. A variant of this bomb has 890 grams of explosives, an amount that creates hazardous fragmentation up to 104 meters away. 

“I have been watching the reporting on these Basij strikes and the use of the Mikholit in particular in open urban areas. It is IDF standard—using precision munitions and even sometimes “low collateral” munitions but in a reckless manner that still puts the civilian population at risk,” Wes J. Bryant, a defence and national security analyst formerly with the Pentagon’s Civilian Protection Center of Excellence told Bellingcat.

Questions Over Legality

International Humanitarian Law defines civilians as “persons who are not members of the armed forces”. Police officers fall under that definition, according to Adil Haque, Professor of Law at Rutgers University and Executive Editor at Just Security.  “As a rule, police are civilians and may not be attacked unless they take a direct part in hostilities,” Haque told Bellingcat. National security analyst Bryant agreed, adding that targeting police “does not stand up to legal scrutiny”.

In an email to Bellingcat, the IDF noted “that the police form part of Iran’s internal security apparatus, which also forms part of Iran’s armed forces, under Iran’s own domestic legislation. In every strike, the IDF takes feasible precautions in order to mitigate incidental harm to civilians and civilian objects to the extent possible under the circumstances.”

Police are indeed “part of the country’s armed forces. By that logic, anything with a flag on it is a legitimate target,” Ali Vaez, the director of International Crisis Group Iran Project, said.

Although Basij is a paramilitary group, any strikes against it would require precautions to minimise harm to civilians, Haque told Bellingcat. “Since the hostilities almost entirely involve aerial bombardment, the concrete and direct military advantage anticipated from strikes on Basij members who qualify as combatants is extremely low, so significant harm to nearby civilians would be disproportionate and illegal,” he said.

When asked about potential civilian casualties in the checkpoint strikes, the IDF told Bellingcat that since the Basij are subordinate to the IRGC and are therefore part of the armed forces, they are regarded as lawful military targets. Regarding the checkpoint strikes specifically, they stated “precision munitions and surveillance means were used in the strikes, as part of the precautions taken under the circumstances to mitigate expected incidental harm”.

Bellingcat reached out to US Central Command (CENTCOM) to ask if the US had any role in the police station strikes identified but received no official comment at the time of publication. 

The data collected so far for these sites can be found here.

---

Miguel Ramalho and Felix Matteo Lommerse contributed to this report.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

The post “Make Iran Ungovernable” – Tracking Efforts To Destroy Iran’s Police Infrastructure appeared first on bellingcat.

BITTER APT spreads ProSpy and ToSpy via Signal, Google, and Zoom lures, targeting journalists through LinkedIn and iMessage spearphishing.

The Persian Gulf is a strategically sensitive region due to energy reserves, maritime trade routes, and ongoing geopolitical rivalries. The recent escalation involving Iran and regional adversaries has reinforced instability in the region and highlighted the growing relevance of Gulf cybersecurity, alongside traditional security concerns.   The expansion of missile systems, drones, and cyber capabilities has increased the likelihood that conflicts could affect both physical infrastructure and digital systems, strengthening the importance of cybersecurity in Middle East frameworks. 

Iran Crisis and Cybersecurity in Gulf Infrastructure Risks 

The Iran crisis has shown that Gulf states are directly exposed to regional conflicts. Critical infrastructure such as ports, energy facilities, desalination plants, and financial hubs has become vulnerable to disruption.   This has increased the role of cybersecurity in Gulf planning as states focus on protecting both operational technology and digital systems that support essential services. For the UAE, this exposure has reinforced the need to secure economic and strategic assets against both kinetic and cyber threats. As a result, cybersecurity in the Middle East is integrated into national security strategies. 

RSCT Perspective and Cybersecurity in Middle East Interdependence 

Regional Security Complex Theory (RSCT), developed by Barry Buzan and Ole Wæver, explains that security threats in the Gulf are interlinked, meaning instability in one state affects others. The Iran crisis reflects this dynamic, where missile strikes, drone operations, and cyber activity can rapidly influence regional stability.  Within this structure, Gulf cybersecurity is also interdependent. A cyberattack on energy or financial infrastructure in one Gulf state can affect supply chains, markets, and maritime operations across the region. This makes cybersecurity in the Middle East a shared regional issue rather than a purely national concern. 

UAE Military Modernization and Cybersecurity in Gulf Defense Posture 

The UAE has expanded its defense capabilities, strengthened strategic partnerships, and engaged in regional security initiatives. It has also adopted a defensive posture relying on systems such as THAAD and Patriot to intercept and neutralize incoming missile threats.  Alongside missile defense, cybersecurity in Gulf resilience has become part of national defense priorities. The increasing use of drones, cyber operations, and long-range missiles has required integration of cyber defense with conventional military systems. This reflects broader cybersecurity in the Middle East adaptation to hybrid warfare. 

Economic Security, Strait of Hormuz, and Gulf Cybersecurity Exposure 

The Iran crisis has reinforced the link between economic and national security in the Gulf. The Strait of Hormuz remains a critical chokepoint for global energy transport, and disruptions have direct effects on trade and supply chains.  Cities such as Dubai and Abu Dhabi function as major global economic hubs. Any disruption to ports, energy systems, or financial infrastructure, whether physical or cyber, can have international consequences. This has increased focus on Gulf cybersecurity to protect economic continuity and system resilience.  Gulf Cooperation Council (GCC) states have discussed deeper security integration, including coordinated air defense systems, intelligence sharing, and maritime security cooperation. These initiatives aim to reduce reliance on external security guarantees while improving regional response capacity. At the same time, states are diversifying partnerships beyond traditional allies. Cooperation with countries such as Pakistan, as well as European and Asian partners, reflects strategic hedging. This diversification extends to cybersecurity in the Middle East, where states seek broader cooperation on digital threats and intelligence exchange.

Bellingcat has identified several high-profile incidents where authorities in the United Arab Emirates have downplayed damage, mischaracterised interceptions and in some instances not acknowledged successful Iranian drone strikes on the country.

A review of official statements shows that the public account does not always align with what can be observed through open sources. This comes as the UAE faces sustained aerial attacks on civilian and economic infrastructure, challenging its image as a secure global hub for business and tourism. Hours after the United States and Israel launched coordinated attacks on Iran on Feb. 28, the Islamic Republic responded by launching an attack against US-allies in the region including the UAE. 

In the wake of the attacks, the UAE’s attorney general warned that publication of images or videos of strikes was illegal. People were also encouraged to report anyone sharing photos or videos of the strikes to authorities. 

The country’s attorney general has ordered the arrest of 35 people and said they would face an expedited trial for “publishing video clips on social media platforms containing misleading, fabricated content and content that harmed defence measures and glorified acts of military aggression against UAE.” Separately police in Abu Dhabi reported they had arrested just over 100 people on suspicion of filming incidents related to Iran’s attacks on the UAE and sharing misleading information online.

Bellingcat contacted the Dubai Media Office, the Fujairah Media Office as well as the UAE’s Ministry of Defence to understand how statements are put out and how distinctions are made between successful drone strikes and damage caused by debris. We did not receive a response by the time of publication.

“Spreading Rumours is a Crime”

During the first days of the conflict several videos were posted on social media, primarily on X, TikTok and Telegram showing footage of Iranian attacks and interceptions across the UAE. 

Around the same time the Dubai Media Office, the X account of the Government of Dubai’s press office, warned followers that legal action would be taken against those sharing “unverified material”.

 The X account of the Dubai Media Office has more than 2.3 million followers making it one of the largest state-run accounts in the country. 

“The public and media are urged to rely solely on official sources for accurate information and refrain from sharing unverified material,” the account posted.

Dubai Police issued similar warnings on social media, stating that sharing content that contradicts official announcements could lead to imprisonment of at least two years and fines of no less than 200,000 dirhams (approximately $55,000).

Despite authorities urging the public to rely on official sources only, Bellingcat found that some of the videos posted online as well as satellite imagery from the region contradicts a number of official accounts of high-profile attacks. For this piece we have only included links to videos that have already been widely published in mainstream news outlets, posted by professional journalists, or have been widely viewed on social media.

Successful Interceptions?

On March 3, a video filmed from a vessel appears to show a drone striking the port of Fujairah, one of the UAE’s most strategically important energy hubs. The port handles roughly 1.7 million barrels of oil per day and is among the world’s largest.

The drone appears to approach its target intact, with no visible sign of interception, Sam Lair, a researcher at James Martin Center for Nonproliferation Studies, told Bellingcat. 

Moments after it descends behind storage tanks, an explosion is heard and a large plume of smoke rises from the site.

On the same day, the Fujairah Media Office stated that a fire resulted from debris following a successful interception, adding that the fire had been brought under control. Satellite images captured on March 4 and 5 show thick black smoke rising from the site. NASA FIRMS data also detected fires on March 3, March 4 and March 5. By March 7, satellite imagery shows at least three storage tanks fully destroyed (25.184565, 56.345481).

Detained in Dubai, a group that provides legal advice to people detained in the UAE, said that a Vietnamese national who filmed the strike on Fujairah port had been detained by authorities after posting the footage online. 

Authorities made a similar report on March 1, stating that a fire at one of the berths of Jebel Ali Port was caused by debris from an aerial interception. Satellite imagery from the same day shows fires at two separate locations – approximately 3 km apart – within the port. One appears to be a central facility associated with fuel handling operations, connected via pipelines to surrounding storage tanks (25.00704, 55.07499). The other is a large structure (24.97953, 55.05204) in the military area of the port, which is one of the US Navy’s busiest ports in the Middle East. The New York Times previously identified an Iranian strike as the cause of the fire at the site. 

Burj Al Arab: A “Limited” Fire

Damage at Dubai’s Burj Al Arab Hotel was attributed by the Dubai Media Office to “shrapnel” from an intercepted drone and described as a “limited” fire. However, footage shows the fire extended to approximately 30 metres in height, covering approximately eight floors of the building, suggesting a far more significant incident than officially described.  

Lair told Bellingcat that the damage appeared more consistent with a direct impact. He added that if the damage had resulted from an interception it would have occurred irresponsibly close to the building.

Fairmont The Palm: Omission of Cause

On Feb. 28, the Fairmont hotel in Dubai’s Palm Jumeirah area was struck by a drone, as shown in footage verified by Bellingcat.

However the Dubai Media office did not confirm a strike took place, instead they stated  only that an “incident occurred in a building in the Palm Jumeirah area,” and urged the public not to share footage.

One video of the fire was shared by a Dubai-based Bloomberg journalist. In the replies to the journalist’s post, multiple users tagged the Dubai Police, a pattern seen across posts documenting the strikes, in an apparent effort to flag violations of the cyber-crime laws to authorities.  

The aftermath of the strike was also captured by a content-creator who has since left the UAE. 

Radha Stirling, founder of Detained in Dubai, told Bellingcat at least five people have been confirmed by the British embassy to have been charged and detained under the UAE’s cybercrime law in connection with documenting this strike. According to Stirling, authorities have sought access to individuals’ phones following incidents to determine whether they filmed or shared footage.

“Even just taking a photo is illegal, it’s illegal to share content that the government deems negative, even in a private message,” Stirling said.

Dubai International Airport: An Unacknowledged Strike

On March 7, the Dubai Media Office announced the temporary suspension of operations at Dubai International Airport, stating only that a situation was being handled under safety protocols. 

Footage that emerged online around the same time, and was verified by Bellingcat, shows a drone strike next to an airport terminal building (25.24165, 55.37498).

Stirling told Bellingcat that she has been in contact with a cabin crew member who was detained after sending an image to colleagues of Dubai airport after an explosion. 

Warda Complex: A Direct Hit

On March 1, a drone struck a residential apartment on the 19th floor of the Warda complex in Dubai (25.004320, 55.293164). Two videos filmed from different angles show the drone hitting the building directly, with no visible sign of interception. In one clip, filmed inside the apartment, a British resident says: “We’ve just been hit by a drone… I didn’t even finish my cup of tea.”

The footage shows relatively limited damage and no explosion, indicating the drone did not detonate. However, the incident appears to show a direct hit by an Iranian drone.

In contrast, statements published the same day by the Dubai Media Office describe air defence activity and attribute sounds heard across the emirate to successful interception operations. Bellingcat was unable to find any acknowledgement of a direct hit in UAE media.

These cases point to a gap between official accounts and observable evidence, raising questions about how incidents are being presented to the public.

Influencers and Narrative Control

At the same time, pro-government messaging has proliferated online. A number of near-identical videos posted by influencers promoting the UAE’s safety and leadership appeared, often using the format: “You live in Dubai, aren’t you scared?” followed by images of UAE leaders and the response: “No, because I know who protects us.” 

Analysis by the BBC found that some of these videos were uploaded within seconds of each other, suggesting coordinated activity.

Stirling told Bellingcat that influencers in the UAE, who require licences to operate, are often paid to promote official narratives. “They are seen as an asset,” she said, describing them as “almost an extension of the government.”

As of April 1, UAE media reported that a total of 12 people had been killed and 190 injured by strikes since the beginning of the war.  

“People are dying. It’s not as safe as the government is reporting. It’s not as safe as influencers are reporting. It’s like a dream narrative that you wish was true.” Stirling said.

Bellingcat also identified a number of incidents in which authorities reported deaths or injuries caused by “debris” following “successful interceptions”. In these cases, however, we were unable to identify supporting photo, video, or other independently verifiable evidence to corroborate the official account.

Notably, fewer videos of such incidents appear to have emerged online in recent weeks, likely as public awareness of detentions under the cyber-criminality law has increased.

Jonathan Dagher, head of the Middle East desk at Reporters Without Borders told Bellingcat that the UAE government was using the Iran war to further restrict independent reporting in the country. 

“When the conflict began, the government stepped up this repression, explicitly prohibiting the public (including journalists) from publishing photos or information related to the strikes, and encouraging the public to report on such incidents.”  

He added that legitimate concerns about national security should not infringe on the public’s right to information. 

“Broad and loosely worded bans on covering events, in the name of security, violate this right and expose journalists to arrest and violence.”

Bellingcat contacted the Dubai Media Office, the Fujairah Media Office as well as the UAE’s Ministry of Defence to understand how statements are put out and how distinctions are made between successful drone strikes and damage caused by debris. We did not receive a response by the time of publication.

Lana Nusseibeh, a representative of the UAE’s Foreign Ministry previously told the BBC: 

“In order for everyone to feel safe it’s important at this time that the information is credible and the sources are reliable. That is the basis of the legislation that has come into play in this State, which is obviously a tense time.” 

She added that her advice for residents, citizens, tourists and journalists in the UAE was to: “Follow the guidelines. The guidelines are there for your safety and for your protection.” 

---

Merel Zoet contributed to this report.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

The post The War You’re Not Allowed to See: How the UAE Rewrites the Story of Iranian Strikes appeared first on bellingcat.

Bellingcat has geolocated and verified two new videos showing the deadly strikes that hit an Iranian Revolutionary Guard Corps (IRGC) compound as well as an adjacent school in the city of Minab in late February.

The new videos were released by Iran’s Ministry of Foreign Affairs and show multiple missiles hitting the complex. 

One of the new videos shows the area around the school being struck while the other shows a nearby IRGC clinic and two buildings within the IRGC facility being hit by Tomahawk missiles. 

Visual and solar analysis of the videos appears to show there was a time gap between when each was filmed, suggesting that there were at least two waves of strikes carried out in the area. 

Applying the same solar analysis techniques to social media footage that showed the school after it had been hit indicates the school was impacted during the first wave of strikes.

Previous investigations by Bellingcat and other news organisations showed a US Tomahawk missile struck the IRGC facility on Feb. 28. 

The US is the only party to the conflict to possess Tomahawk missiles.

Media reports, including from the New York Times and Reuters, have since detailed that a preliminary investigation by the US military concluded it was likely a US strike that hit the Shajarah Tayyebeh elementary school.

According to Iranian media, at least 175 people were killed in the attack, including children.

Analysing New Minab Videos

The first video (video one) is filmed from just over 2.5 kilometres (1.5 miles) away from the IRGC base and shows at least 10 missiles impacting the area over a period of 50 seconds.

The first explosion is visible five seconds into the video. The area around where the school was located is struck at 14 seconds. This is the fourth explosion visible in the footage.

Another structure that was damaged in the strikes is situated approximately 100 metres away from the school in the same general area. It was therefore not possible to determine which exact structure was hit from this footage alone.

The second new video (video two) was filmed approximately two kilometres southeast of the school, and is of a higher quality than video one. This video shows three Tomahawk missiles in the moments before impact.

Video two includes annotations and pauses when each Tomahawk appears on screen. 

A frame-by-frame analysis also shows what appear to be two minor visual glitches where some frames are transposed and annotations were added, highlighting when missiles can be seen.

The second impact seen in video two is the same as seen in footage released by Iranian media in early March, and previously reported on by Bellingcat and others, only from a different perspective.

Video two also only shows the southern part of the base, with its northern section not visible. The school is located on the northern edge of the base and is therefore not visible in video two.

Bellingcat asked the Iranian Ministry of Foreign Affairs why only part of the strike, as seen in video one, was released and if there was a longer version that may show further impacts. We did not receive a response before publication.

Bellingcat also asked the US Department of Defense whether it had any further information on the strike since its reported preliminary findings. It referred us to CENTCOM, which said: “We have nothing for you on this. The investigation is still ongoing.”

Geolocating the Videos

Bellingcat was able to geolocate and verify video one by tracing sightlines on satellite imagery to determine the camera’s location and identify objects such as buildings, trees and a water tower within the IRGC facility. 

According to this analysis, video one was most likely filmed from an electric substation southeast of the school.

Once all key elements were identified and geolocated, we analysed each explosion that can be seen in the footage. 

Fourteen seconds into video one, the fourth impact appears to hit the area immediately around the school, which was approximately 200 meters behind a water tower. 

While the school was walled off and outside the IRGC facility, the water tower and another building (situated between the school and the water tower) are located within it.

Due to the relatively small distance between the school and the other IRGC building (roughly 100m), it was not possible to determine what structure was hit at the moment of the strike visible in video one.

More information, such as obtaining the entire strike video sequence, would be needed to fully determine which structure was hit in this footage. However, social media footage captured at the scene does suggest that the school was hit around this time.

For video two, we stitched together a rough panorama of what could be seen in the footage. 

This made it possible to match up multiple buildings visible southeast of the IRGC base and school, while also building rough sightlines to show which part of the base was being filmed.

Bellingcat was able to narrow down the areas hit by the three missiles seen in video two by comparing it with the point of view of a short video released in early March, showing a Tomahawk hitting the complex, as well as with what could be seen in video one. Post-strike satellite imagery also helped confirm the buildings that were hit in the footage. 

We were thus able to determine that video two shows an IRGC clinic and two buildings within the IRGC compound being hit.

Time of the Strikes

The Iranian Ministry of Foreign Affairs has claimed that two waves of strikes occurred. 

Initial analysis did suggest that video one and two appeared to be filmed at different times as the strikes visible in each clip cannot be synced up. 

Solar data also gives clues as to the time each was taken, suggesting that there was a time gap of at least an hour between the strikes seen in the two videos.

According to the New York Times, the strikes were first reported on social media just after 11:30 am.

Solar data, derived by the direction of shadows visible in video one and simulated via the SunCalc platform, appears to indicate it was filmed between 10:30 and 11:30am.

Analysing the shadows seen in the earlier March video using the same method, appears to show that it was filmed between 13:30 and 14:30. 

This would seem to indicate that video two and the earlier March video were likely filmed after video one.

Solar data from a video posted to Telegram showing the smouldering school, and damage to the nearby IRGC building about 100m away, shows that it was recorded around the time of the first video.

This, therefore, appears to confirm that the school was impacted before the wave of attacks seen in video two.

Iranian media previously released images of munition remnants they claim they recovered from the school. 

Bellingcat was not able to verify where the remnants were originally found, but was able to identify them as Tomahawk missile remnants. The New York Times also confirmed this identification by matching the contract number on a remnant to a contract for the Tomahawk missile.

---

Bellingcat’s Carlos Gonzales, Jake Godin and Trevor Ball contributed research to this article.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

The post Two Waves of Bombing: New Videos Reveal Further Details About Iran School Strike appeared first on bellingcat.

The US appears to have deployed the Gator Scatterable Mine system over Kafari, a village near Shiraz, in southern Iran overnight. Several people were killed according to Iranian media. 

Three experts told Bellingcat the munitions appeared to be air-delivered US-made Gator anti-tank mines. 

The US is the only participant in the Iran war known to possess Gator Scatterable Mines. 

Bellingcat asked the US Department of Defense whether it had dropped the mines overnight, but did not receive a response at time of publication.

Dr NR Jenzen-Jones, Director of Armament Research Services, told Bellingcat that the images appeared to show US-made anti-tank landmines. 

“These images show what appear to be American BLU-91/B scatterable anti-tank landmines. 

“The BLU-91/B is dispensed from the CBU-78/B or CBU-89/B air-delivered cargo bombs (cluster munitions). 

“The presence of square ‘aeroballistic adaptors’ indicates that the mines seen here were delivered by air. Similar mines can be dispensed from the vehicle- or helicopter-based Volcano system.”

Amael Kotlarski, Weapons Team leader at Janes, also identified the mines as BLU-91/B ‘Gator’ anti-tank mines. Kotlarski told Bellingcat “the BLU-91/B is dispensed from either the US Air Force’s CBU-89/B (72 BLU-91/B and 22 BLU-92/B) or the US Navy’s CBU-78/B (45 BLU-91/B and 15 BLU-92/B).”

He elaborated that the BLU/92B is an anti-personnel mine, similar in appearance to a BLU/91B, though not identical.

“No BLU-92/B is observable in the photographic evidence presented so far. This could be that they have not been found, or that the dispensers were loaded solely with AT mines to help reduce the risk to civilians.”

Gator Scatterable Mines System

The Gator system is an air-delivered dispenser system or cargo bomb that distributes mines over an area. These dispensers contain a mixture of either 94 or 60 BLU-92/B anti-personnel and BLU-91/B anti-vehicle mines depending on which dispenser is used. These dispensers release the mines over an area of approximately 200 by 650 metres.  In the images reviewed by Bellingcat, it is not clear which dispenser was used, or how many dispensers were deployed.

Andro Mathewson, an independent open source analyst, who formerly worked at landmine-clearing NGO The HALO Trust, told Bellingcat the images showed BLU-91/B mines.

Some of the images of the mines posted by Iranian media show an aeroballistic adaptor. The aeroballistic adaptor is only present on the BLU-91/B and BLU-92/B, not on other mines within the US Family of Scatterable Mines (FASCAM), indicating that these were deployed from a Gator system aircraft dispenser.

BLU-91/B and BLU-92/B Mines and Self-Destruct Features

Both BLU-91/B and BLU-92/B mines are activated two minutes after being deployed; however, a very small number can fail to properly arm and explode. These mines also have self-destruct features with a variable delay which means they may randomly explode hours or days after they are dispensed. They may also explode if disturbed. These features make them particularly dangerous.

The self-destruct can be set for 4 hours, 48 hours, or 15 days, but the mines may self-destruct before then.

So far, only visual evidence of magnetically influenced BLU-91/B anti-tank mines has been posted online, but these mines are usually deployed alongside the anti-personnel BLU-92/B. The BLU-92/B also deploys tripwires.

In addition to the self-destruct features, the BLU-92/B anti-personnel mines have an anti-handling device (AHD) that is intended to make the mine explode when disturbed. While BLU-91/B anti-tank mines do not have an anti-handling device (AHD), they “may detonate when moved, because the mine may sense a significant change from its original orientation.”

Amael Kotlarski of Janes told Bellingcat that “The mine will go off if subjected to significant movement.” This could explain local reports that a man was killed when he picked one up near his car. 

Uniquely US Weapons

The US is the only participant in the war known to possess these mines. They were developed after the US stopped supplying arms to Iran. A review of Stockholm International Peace Research Institute’s (SIPRI) Arms Transfer Database, and US Major Arms Sales does not show any transfers of these mines to Israel.

Dr Jenzen-Jones also told Bellingcat that “Scatterable anti-tank landmines may have been employed to deny vehicles access to or from so-called ‘missile cities’. This could both prevent TELs [missile launch vehicles] from leaving, and limit efforts to re-establish access to facilities (for example, by preventing excavators from operating at collapsed entrances).”

Bellingcat geolocated some of the mines to the village of Kafari, Iran (coordinates 29.50544059, 52.48745447 and 29.50964897, 52.48920842). This video shows at least three mines approximately two kilometres away from the entrance to what is reported to be Shiraz South Missile Base, an Iranian “missile city.” 

Bellingcat asked the US Department of Defense to confirm whether they dropped mines in this area, how many were deployed, and what the intended target was. They did not respond at time of publication.

Bellingcat was unable to determine how many more mines were scattered over the village. Some mines may not yet have been found due to where they landed. 

---

Bellingcat’s Carlos Gonzales and Logan Williams as well as Felix Matteo Lommerse contributed research to this article.

The post Evidence Points to US Scattering Mines over Iranian Village appeared first on bellingcat.

The Netherlands’ largest newspaper, De Telegraaf, recently published an interview with a woman claiming to organise her own evacuation flights from Dubai, selling seats at €1,600 (US$ 1850) each. Four days later, her photo was removed from the article, though the interview remained.

Bellingcat has found that the original image not only includes artefacts commonly associated with generative AI, but that the flights referenced in the article do not appear to exist.

The story came at a time when thousands of Dutch people were reportedly seeking urgent ways to leave the region following Iranian missile and drone strikes across the Gulf in retaliation for US-Israeli strikes.

Published on De Telegraaf’s website on March 5, the headline reads: “Dutch people in the Middle East feel abandoned by the government: We just rented a plane ourselves.”

The Dutch minister of foreign affairs was confronted with this headline during a television interview, in which he described ongoing efforts by the Dutch government to repatriate citizens to the Netherlands.

The article features interviews with several Dutch people struggling to leave Dubai and Abu Dhabi, including Tamara Harema. Under the subheading “Dutch people hire their own plane”, Harema says she was “rebooked five times by Emirates” and that the official repatriation flights organised by the Dutch government were not ‘taking off’.

As part of a group, she says, they are organising buses and have hired an Airbus A321 to fly home. Harema is quoted as saying: “The first plane is already full, so we’re organising a second flight. Stranded travellers can contact us.”

However, several discrepancies in Harema’s photo, published in the original article, suggest it was AI-generated. No trace of a person matching Harema’s face or profile could be found, and flight-tracking data suggests no such plane took off.

The Photo

In the image below, the world’s tallest structure, Burj Khalifa, can be seen through the window overlooking the Dubai skyline. Each side of the tower is unique, with platforms that protrude at different heights and in different directions. It also contains several mechanical floors, which appear as dark bands in the photo.

By cross-checking the height of the visible platforms together with the location of the mechanical floors, it’s possible to determine that Harema’s hotel room faces north-west, towards the Burj Khalifa’s south-east-facing facade.

Several discrepancies are visible when comparing Harema’s photo with other images of the building, including an upper mechanical floor appearing higher than in other images and the absence of the water feature at the base of the building.

To establish whether Harema’s photo could have been taken several years earlier, Google Street View imagery was analysed from 2013 onwards. No match could be found when comparing the arrangement of buildings at the base of the Burj Khalifa.

Several other irregularities, as shown below, including the hotel room furniture and details of Harema’s clothing and jewellery, also suggest it may have been AI-generated.

Fully Booked Airbus A321

Regarding whether the plane existed, Harema says in her interview that buses have already been arranged to collect passengers from two locations in Dubai on Saturday, March 7, after which a 232-seater Airbus A321 will depart from Muscat, Oman, for the Netherlands.

The article notes the cost is €1,600 (US$ 1850) per person, without detours. “Although we read that a Dutch repatriation flight costs €600, just try getting on such a flight,” says Harema.

According to Flightradar24, multiple A321s departed Muscat on March 7 and 8, but none bound for the Netherlands. The only aircraft that did arrive in Amsterdam from Muscat were either government-organised repatriation flights or scheduled Oman Air services, none of which were Airbus A321s.

Two Airbus A321s were recorded on the ground at Muscat Airport on March 7. One, belonging to Gulf Air, later departed for Rome via Riyadh March 8. The other, operated by SalamAir, had been flying routes between Oman and Bangladesh until March 3, but has since remained in Muscat.

After contacting De Telegraaf, an explanation for the photo’s removal was added at the bottom of the article, stating that the photo did “likely not meet our journalistic guidelines.”

The newspaper’s deputy editor-in-chief, Joost de Haas, added:

“Regarding the quoted Tamara Harema, the editors contacted her after Mr. Chizki Loonstein—a long-standing source for one of our reporters—informed us about attempts to charter a plane. Mr Loonstein informed us that Ms Harema stayed in Dubai and could tell us more about it. This led to messages from which several quotes from Harema were extracted, as reproduced in the relevant passage of the article.”

A search for Loonstein led to a six-month-old report from another Dutch newspaper, NRC, which claimed that Loonstein, a lawyer, emigrated to Dubai after his legal company went bankrupt, leaving his clients, victims of fraud, worse off.

Contacted for comment, Loonstein confirmed that he knew Harema and had shared her contact details in “an app group” in relation to a flight from Muscat to Amsterdam. After this contact, Bellingcat sent him the photo of Harema to confirm her identity and asked him to share Harema’s contact details. In response, Loonstein refused to provide further comment. 

---

Merel Zoet and Claire Press contributed to this report.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

The post AI Used to Promote Non-Existent Evacuation Flights From the Middle East appeared first on bellingcat.

To stay up to date on our latest investigations, join Bellingcat’s WhatsApp channel here.

Bellingcat has geolocated footage of multiple Tomahawk cruise missiles travelling through Iraqi airspace towards Iran, either in violation of its airspace or with Iraq’s consent.

Bellingcat identified at least 20 individual cruise missiles and geolocated them over Iraqi Kurdistan including alongside Mount Piramagrun, in the Zagros Mountain range, and approximately 50 km southeast of the city of Kirkuk.

Modern Tomahawks can travel up to 1600 km, and are used for precision strikes. At the start of the war, the US had a carrier strike group in the Mediterranean and the Arabian Sea, as well as some independently deployed destroyers.

The US is the only participant in the war known to possess Tomahawks, which can be launched by ships or submarines. US President Donald Trump said at a press conference on Monday that Iran “also has some Tomahawks”. Official ​​government reports on Iran’s military balance don’t support this claim.

Considering the distance of US vessels to the geolocated missiles, the missiles seen in the videos were most likely fired from the Mediterranean Sea, Sam Lair, a research associate at the James Martin Center for Nonproliferation Studies, told Bellingcat.

Red Sea launches would be pushing the maximum range, and US Navy ships were not known to have been in the Persian Gulf at the start of the war, Lair said.

Brian Finucane, a senior adviser with the US Program at the International Crisis Group, told Bellingcat that without the consent of Iraq and Syria, the intrusion of Tomahawk missiles into their airspace “would violate its sovereignty and international law”. 

We asked the US State Department and Department of Defense as well as the foreign ministries of Iraq and Syria, if ​​the US had an agreement with Iraq or Syria to utilise their airspace for cruise missiles targeting a third country. The Department of Defense told Bellingcat they “had nothing to provide” while neither the Iraqi nor Syrian ministry had responded at the time of publication.

On Tuesday, Iraqi Prime Minister Mohammed Shia al-Sudani spoke with US Secretary of State Marco Rubio and stressed that Iraqi airspace and territory should not be used for any military action targeting neighbouring countries, the prime minister’s media office said.

Bellingcat geolocated at least eight videos showing Tomahawk missiles over Iraq. The videos show at least 20 individual Tomahawk missiles, based on the longest uninterrupted video we reviewed.

The below graphic shows all Tomahawk missiles Bellingcat has geolocated, which includes additional missiles identified outside of Iraq.

Click the arrows in the map below to view the verified missile sightings, including the original footage and geolocation analysis.

Interactive map showing the approximate locations of US carrier groups in the region at the start of the war, with a 1600 km range, in relation to Tomahawks geolocated by Bellingcat. We included a possible Red Sea launch point for visualisation, reference and comparison purposes only. The white arrows indicate the location of Tomahawk sightings. Their respective directions of travel are shown by default. All coordinates and directions shown are approximate. Source: Logan Williams/Bellingcat.

These missiles don’t always make it to their intended target. In addition to footage of the airborne missiles, Bellingcat also identified remnants of a Tomahawk missile that had crashed outside Kafr Zita in northwest Syria.

Missiles Fired From the Sea

On the first day of the war, Feb 28, the US Central Command (CENTCOM) published footage of Tomahawk missiles being fired from the sea. Later on March 1, CENTCOM released additional video of the USS Thomas Hudner (DDG-116) firing a Tomahawk missile, while operating in the Eastern Mediterranean Sea. 

According to a Center for Strategic and International Studies (CSIS) analysis, more than 160 Tomahawk missiles may have been used in the first 100 hours of the war, and “they would have been used to destroy Iranian air defenses and other counter-air capabilities and create permissive conditions for follow-on attacks”.

Arleigh Burke-class guided-missile destroyer USS Thomas Hudner (DDG 116) fires Tomahawk land attack missiles in support of Operation Epic Fury, Mar. 1, 2026. (U.S. Navy video)

Tomahawk Flights Through Iraqi Airspace

The footage analysed by Bellingcat showing cruise missiles travelling over land is consistent with the typical flight profile of Tomahawks, which cruise at low altitude along pre-programmed routes toward distant targets. 

According to the US Navy, “Tomahawk cruise missiles are designed to fly at extremely low altitudes at high subsonic speeds, and are piloted over an evasive route by several mission tailored guidance systems.”

This explains why they are sometimes filmed by civilians during transit. Similar sightings have previously been recorded during US conflicts in the Middle East. 

Bellingcat analysed terrain features and solar data in the footage and confirmed the location and approximate direction of travel of the Tomahawk missiles. We found that they followed the terrain closely, and appeared to follow two different valleys near the Iraq-Iran border.

The Zagros mountain range stretches across much of Iran as well as northern Iraq. The mountains of this valley would provide details for the Tomahawks’ terrain matching guidance, and hide them from Iranian radar detection.

Click the arrows in the map below to view the verified missile sightings, including the original footage and geolocation analysis.

Interactive map showing the locations of Tomahawk sightings. The missiles were travelling through Iraqi airspace towards Iran in valleys near the Iraq-Iran border, and near Kirkuk. The respective directions of travel are shown (white arrows). All coordinates and directions shown are approximate. Source: Logan Williams/Bellingcat.

Other Geolocated Footage 

In a video filmed in Tehran and posted on the first day of the war, six Tomahawk missiles can be seen flying over the Qurkhane Bus Terminal in Tehran, as an anti-aircraft gun on a nearby building fires at them. Other gunfire can be heard in the distance.

Bellingcat previously geolocated a Tomahawk strike in Manib, Iran, near a school where 175 people, including children, were reported to have been killed.

A final video analysed by Bellingcat, posted on March 3, shows 13 Tomahawk missiles flying past a commercial ship in the direction of Iran, the M/V MAERSK BOSTON, while it was off the coast of Oman, according to solar, visual and Marine Traffic data.

New Tomahawk Variants

Since the beginning of the war, two new variants of Tomahawk missiles have been observed.

One Tomahawk variant seen publicly for the first time, distinguished by its visible black body, believed to be a stealth coating. Other missiles appear to have wings angled forwards, a modification designed to make them harder to detect by radar, according to an analysis by The War Zone.

Clobbering

Sam Lair, a research associate at the James Martin Center for Nonproliferation Studies, told Bellingcat that Tomahawks have GPS guidance and use terrain matching to determine their location. When there is an error in guidance, some missiles can “clobber” and hit the ground.

The US stopped firing Tomahawk missiles over Saudi Arabia during the 2003 Iraq War after some crashed in the country while attempting to strike targets. About ten Tomahawk missiles crashed during that war, with some landing in Iran and Turkey as well.

---

Bellingcat’s Logan Williams and Felix Matteo Lommerse contributed research to this article. Livio Spani, Anisa Shabir, Afton Briones, Mathis Noizet, and Nicole Kiess from Bellingcat’s Volunteer Community also contributed to this piece.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

The post Tracing Tomahawks: US Missiles Bound for Iran Spotted Over Iraq appeared first on bellingcat.

As tensions linked to the ongoing West Asia conflict continue to shape the geopolitical environment, India’s technology industry body NASSCOM has urged member companies to remain alert and strengthen operational preparedness. The NASSCOM advisory highlights the need for heightened vigilance across business continuity and cybersecurity frameworks amid developments in the Middle East.  The Nasscom advisory states that while business operations for companies remain stable at present, organizations are proactively reassessing contingency plans. Firms are reviewing operational safeguards and resilience measures to minimize potential disruption if the West Asia conflict in the Middle East escalates further. 

Nasscom Advisory Highlights Operational Preparedness 

The official Nasscom advisory, titled “Strengthening Operational and Cyber Resilience Amid Evolving Middle East Situation,” outlines a set of measures companies should implement in response to the geopolitical developments linked to the West Asia conflict.  According to the advisory, organizations should ensure their business continuity frameworks are fully prepared to address potential disruptions across the Middle East. Even though services are currently functioning normally, the advisory stresses that companies must be ready to respond quickly if the situation deteriorates.  The advisory notes, “Nasscom Advisory: Strengthening Operational and Cyber Resilience Amid Evolving Middle East Situation. Considering the geopolitical situation in the Middle East, Nasscom has issued another advisory to member companies, urging heightened vigilance and preparedness across business continuity and cybersecurity frameworks.” 

Companies Reviewing Business Continuity Plans 

One of the key recommendations in the Nasscom advisory relates to the activation and review of business continuity plans. Companies with operations or exposure to the Middle East are examining contingency frameworks to ensure operational stability if the West Asia conflict disrupts regional infrastructure or logistics.  These contingency measures are intended to help maintain uninterrupted service delivery even if regional instability affects normal operations. 

Employee Safety Prioritized as Middle East Tensions Persist 

The Nasscom advisory also stresses the importance of employee safety. Companies have been asked to prioritize the well-being of staff members located in areas affected by the West Asia conflict.  Many organizations are enabling remote work arrangements for employees based in impacted geographies across the Middle East. Firms are also closely monitoring the situation to ensure the safety of their workforce.  Another focus area highlighted in the Nasscom advisory involves strengthening technology infrastructure resilience. Companies are assessing alternative routing options for cloud infrastructure and data centers located in or connected to the Middle East.  These steps aim to protect critical systems and ensure that services remain operational even if regional disruptions linked to the West Asia conflict affect connectivity or infrastructure. 

Travel Advisories Issued Due to West Asia Conflict 

Given that the Middle East serves as a major global transit hub, the Nasscom advisory recommends limiting non-essential travel through the region. Companies have been advised to explore alternative transit routes where possible to avoid potential disruptions arising from the West Asia conflict. Employees are being encouraged to postpone or reconsider travel plans unless necessary.  The Nasscom advisory also calls on companies to maintain proactive communication with customers. Firms are engaging with clients to provide updates about preparedness measures and reassure them about service continuity despite uncertainties linked to the West Asia conflict.  Maintaining transparent communication, the advisory notes can help minimise concerns among clients with operations tied to the Middle East. 

Cybersecurity Risks Rise During Geopolitical Tensions 

The Nasscom advisory warns that geopolitical instability, including the ongoing West Asia conflict, often leads to an increase in coordinated cyber threats, disinformation campaigns, and attacks targeting critical infrastructure. To address these risks, organizations have been asked to treat several cybersecurity actions as immediate priorities.  These include rotating credentials across the organization and applying patches for critical Common Vulnerabilities and Exposures (CVEs). The advisory also recommends enforcing multi-factor authentication across all external access paths, such as VPNs, RDP, SSH, and cloud administration systems.   Implementing conditional access controls can help counter token theft and adversary-in-the-middle attacks. 

Supply Chain and DDoS Readiness Highlighted 

The Nasscom advisory further advises companies to conduct thorough audits of third-party vendors, especially those with exposure to the Middle East. According to the advisory, a single compromised vendor could potentially trigger disruptions across the broader industry supply chain.  Companies have also been urged to prepare for potential distributed denial-of-service (DDoS) attacks by coordinating with internet service providers and cloud partners to ensure adequate mitigation capacity.  To strengthen resilience, the Nasscom advisory recommends maintaining offline and immutable backups for critical systems such as industrial control systems, operational technology environments, core banking platforms, and healthcare infrastructure.  Employee awareness is also considered a key line of defense. Organizations are being encouraged to conduct training sessions to help staff recognize social engineering attempts that may exploit narratives around the West Asia conflict or fake government alerts. 

New video footage shows a US Tomahawk missile hitting an Islamic Revolutionary Guard Corps (IRGC) facility in Minab, Iran, on Feb 28, showing for the first time that the US struck the area.

The footage, released by Mehr News and geolocated by Bellingcat, also shows smoke already rising from the vicinity of the girls’ school where 175 people were reportedly killed, including children.

New video footage shows a US Tomahawk missile hitting an IRGC facility in Minab, Iran, on Feb 28, showing for the first time that the US struck the area. The footage also shows smoke already rising from the vicinity of the girls’ school, where 175 people were reportedly killed. pic.twitter.com/4jBXrNcRJO

— Trevor Ball (@Easybakeovensz) March 8, 2026

The footage would appear to contradict US President Donald Trump’s claim that it was an Iranian missile that hit the school.

The US is the only participant in the war that is known to have Tomahawk missiles. Israel is not known to have Tomahawk missiles.

The red cone superimposed over this image shows the estimated area of impact of the missile visible in the footage. The graphic also shows the position of a clinic, the school and other damaged buildings.

Planet Labs satellite imagery shows that only two structures within this red cone were damaged, including a clinic.

The other structure appears to be an earth-covered magazine or bunker.

---

Giancarlo Fiorella and Merel Zoet contributed research to this piece.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

The post Video Shows US Tomahawk Missile Strike Next to Girls’ School in Iran appeared first on bellingcat.

The Israeli Air Force (IAF) has dropped 5,000 bombs on Iran since the United States and Israel launched an attack last week, according to a statement by the IAF on March 4.

Bellingcat has monitored weapons used in the first few days of the war, and strikes across the region, including those that caused civilian harm. Some weapons, such as the US Precision Strike Missile, have seen their first use in combat. A variant of the Tomahawk missile, previously unknown to the public, was also used.

On March 3, the IAF posted three images in three separate posts showing a bomb not publicly seen in Israeli service before. The Israel Air Force released these photos accompanied with claims they were of jets participating in the strikes on Iran. Experts told Bellingcat that this bomb appears to have an incendiary component, and may be one intended to destroy chemical or biological warfare agents.

The images appear to show 2,000-pound-class air-delivered bombs fitted with Joint Direct Attack Munition (JDAM) guidance kit with a red band around the nose. Red is commonly used to denote an incendiary, while yellow indicates high explosive effect.

We identified key details about the munition and shared the images with two weapons experts.

Apparent Similarities to the MK 84

Dr N.R. Jenzen-Jones, the director of Armament Research Services (ARES), a weapons intelligence consulting company, told Bellingcat these images show a 2,000-pound-class air-delivered bomb fitted with a Joint Direct Attack Munition (JDAM) guidance kit.

Frederic Gras, an Explosive Remnants of War (ERW) expert, also told Bellingcat that the bomb could be of the US MK 80 series, or an Israeli copy, and has a JDAM guidance kit.

The US JDAM bomb guidance kit is designed for use with bombs that use the MK 80 series bomb bodies, and the closely related BLU-109 “bunker buster” body. 

The Open Source Munitions Portal added the munition to their website on March 3, describing it as “visually similar to a MK 84 general purpose aerial bomb”, while noting that “the marking scheme is distinctly different”. The War Zone also reported on these distinct markings, and possible munitions it could be.

“The combination of yellow and red bands probably indicates both a high explosive and incendiary payload, which would be consistent with a 2,000-pound-class bomb of MK 84 form factor known as the BLU-119/B Crash Prompt Agent Defeat (CrashPAD),” Dr Jenzen-Jones told Bellingcat.

Frederic Gras, an Explosive Remnants of War (ERW) expert said that the US and Israel both use red markings to indicate an incendiary payload, or effect. The bomb could be a full incendiary payload, with the yellow band indicating a bursting charge, or it could be a bomb primarily with a high explosive component, and a secondary incendiary effect, Gras added.

Red Bands on Israeli Weapons

It’s not the first time the Israeli Air Forces has published weapon images with red bands marking the warhead or payload section of a munition. Shortly after the start of the Gaza War in 2023, the IAF posted a photo which included an Apache attack helicopter with a Hellfire missile with a red band. The IAF deleted the post and replaced it with a similar photo of an Apache without this missile.

This fueled speculation online that this could be an incendiary or the thermobaric variant of the Hellfire missile, the AGM-114N. It has been approved by the US for sale to Israel.

M825A1 155mm white phosphorus artillery projectiles, munitions designed to create smoke, used by Israel also have a red band and a yellow band around the nose. 

Israeli munitions which are not incendiary have also been spotted with light red bands over the fuel tanks for munitions with jet engines, such as the Delilah cruise missile.

Designed To Target Chemical or Biological Weapon Stockpiles

The markings are consistent with the US-produced CrashPAD, but “given the possible CBW [chemical and biological warfare] threats Israel has long faced from Iran, it is entirely plausible that an Israeli analogue was developed,” Dr Jenzen-Jones told Bellingcat.

The CrashPAD contains white phosphorus and high explosives, and is designed to destroy biological and chemical warfare agents according to US government documents.

Dr Jenzen-Jones told Bellingcat that the CrashPAD is the only publicly known weapon of this type utilising a MK 84 bomb body although there are several programs producing similar munitions. A penetrating variant is known as the Shredder but it uses a modified BLU-109 bomb body, which is visually different from the MK 84 bomb body visible in the IAF photos.

CrashPAD has been in the US inventory for nearly two decades. “Chemical Agent Defeat weapons, such as Crashpad, are not illegal”, and they must undergo a legal review to ensure compliance with US domestic and international law, Michael Meier, former Senior Advisor to the Army Judge Advocate General for Law of War and current Adjunct Professor at Georgetown University Law Center, told Bellingcat.

“The express purpose for the reservation is that these weapons, such as Crashpad, are the only weapons that can effectively destroy certain targets such as biological weapons facilities, for which high heat would be required to eliminate bio-toxins,” Meier said.

Dr Arthur van Coller, Professor of International Humanitarian Law at the STADIO Higher Education, told Bellingcat that “if the CrashPAD is used as designed, i.e. to target chemical or biological weapon stockpiles sufficiently removed from civilian populations, then its use is consistent with IHL [International Humanitarian Law] and treaty law, even under CCW [Certain Conventional Weapons], Protocol III.”

Dr Arthur van Coller also said that the “United States and Israel are State Parties to the CCW itself,” but only the US is also a party to Protocol III on incendiary weapons, albeit with reservations, which means that Israel “is not legally bound by Protocol III’s restrictions on incendiary weapons (including those applying to CrashPAD) under treaty law”. Iran is not a party to the CCW at all.

The US is a major supplier of weapons to Israel, and has sent thousands of MK 80 series and BLU-109 bombs to the country. Israel also produces some MK 80 series bombs.

Israel and US Responses

The US Defense Security Cooperation Agency, which publishes details of some major arms sales, does not mention any transfers of the CrashPAD. Bellingcat asked the Department of State if the CrashPAD or weapons with similar capabilities were transferred to Israel. Bellingcat also asked the Department of State if they assessed that Iran had a chemical weapons program. A State Department Spokesperson told Bellingcat that “The Trump administration backs Israel’s right to self-defense” and referred Bellingcat to the IDF for questions about procurement and munitions used.

The US Department of Defense did not respond to requests for comment by the time of publication. 

Bellingcat asked the IDF what the bomb was, if it was supplied by the US, if it contained white phosphorus, thermobaric or fuel air explosives, and if the IDF assessed that Iran had a chemical weapons program. The IDF told Bellingcat that it “will not be able to provide details regarding the types of munitions it uses. With that said the IDF uses only legal weapons and ammunition.”

---

Bellingcat’s Carlos Gonzales contributed research to this article. Livio Spaini from Bellingcat’s Volunteer Community also contributed to this piece.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

The post The Incendiary Bomb Never Seen in Israel Before appeared first on bellingcat.

US President Donald Trump said on January 2 that the US was “locked and loaded and ready to go”. Trump was talking aloud about intervening in Iran if it continued a violent crackdown on demonstrators who had taken to the streets over spiralling inflation and ongoing repression. 

Thousands of Iranian’s were reported to have been killed by state security forces in just under a month. According to Amnesty International, the Islamic Revolutionary Guard Corps (IRGC), the Basij plainclothes militia, police forces and other plain-clothed agents carried out the deadliest violence against protesters in decades.

On Saturday, February 28, the United States and Israel launched a large-scale attack against Iran, killing Supreme Leader Ayatollah Ali Khamenei and targeting military infrastructure throughout the country. President Trump initially told Iranians they should seize control of the government but on Tuesday this week said: “If you’re going to go out and protest, don’t do it yet. It’s very dangerous out there. A lot of bombs are being dropped.” Almost 800 Iranians have been killed in US and Israeli strikes so far, according to the Iranian Red Crescent. 

While the US has released a list of military targets, including IRGC headquarters and missile systems, Bellingcat has reviewed strikes against another type of target inside the Islamic Republic — police stations.

Experts told the New York Times that strikes against these facilities may be part of an effort to motivate Iranians to challenge the regime, although satellite analysis alone doesn’t allow us to tell if it is the US, Israel or both nations who have targeted police stations.

Mapping Targeted Police Stations

Using medium-resolution PlanetScope satellite imagery from Planet Labs, Bellingcat has been able to locate at least 15 local police stations or similar buildings that were struck between March 1 and March 3. Videos and photos shared on social media also show the aftermath of some of these strikes.

Comparing the March 1 PlanetScope satellite imagery with imagery taken on March 3, it’s possible to make out visible signs of building destruction throughout Tehran. Some of these sites have already been widely-reported on, including the strike on Supreme Leader Ali Khamenei’s compound and official residence.

But Bellingcat reviewed damage to a number of smaller buildings throughout Tehran and cross-referenced the locations with data on Google Maps, Open Street Maps and Wikimapia where we found that several were listed as police stations. The majority of sites we identified are in dense urban areas. 

Video shared by Iranian state broadcaster Tasnim News showed the aftermath of a strike on what it describes as a “diplomatic police station” near Ferdowsi Square — one of downtown Tehran’s main intersections. Another video taken at the same location shows at least two people on the ground with a large amount of damage to nearby buildings. Geolocation of the videos puts them at 35.7032, 51.4189, adjacent to a school and office buildings. 

Another video, geolocated by a volunteer with Geoconfirmed — a volunteer geolocation collective — shows a heavily damaged police station near Tehran’s Grand Bazaar. PlanetScope imagery from March 3 shows heavy damage to the area around the police station.

Photos and video from the Golestan Palace, a UNESCO World Heritage Site that sits adjacent to the police office, shows that it also sustained damage.

Iran’s Police and Law Enforcement

Iran’s security apparatus includes a network of police, plain clothes officers, civilian militia battalions known as Basij and the Islamic Revolutionary Guard Corps. During recent protests security forces were seen shooting protestors on the streets, and many of those killed showed signs of being shot in the head.

Iran has experienced several waves of anti-regime protests over the past 15 years, all of which have been put down by the authorities who have not shied away from using extreme violence to contain them.

Although the Financial Times reported speaking to a Tehran resident that said one of the police stations we identified, in the Gisha neighborhood, had hosted a branch of Iran’s morality police, it is thus far unclear from the satellite data whether any of the police stations had any particular role during the recent protests.

---

Trevor Ball, Logan Williams and Felix Matteo Lommerse contributed reporting to this piece for Bellingcat. Anisa Shabir and Stéphanie Ladel contributed from Bellingcat’s Volunteer Community.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

The post Satellite Imagery Reveals Strikes on Iranian Police Stations appeared first on bellingcat.

The geopolitical landscape of the Middle East has entered one of its most volatile phases in decades. On February 28, 2026, tensions that had been simmering for years erupted into a full‑blown conflict involving the Islamic Republic of Iran, the United States, and Israel. A confluence of diplomatic stalemate, military posturing, and covert cyber preparations set the stage for what would evolve from a localized confrontation into an expansive, multi‑domain campaign.  

The conflict’s opening salvo — codenamed Operation Epic Fury by the US and Operation Roaring Lion by Israel — was not just a conventional military assault. It was a synchronized hybrid offensive in which cyber operations were integrated as a co‑equal domain with kinetic strikes, psychological messaging, and information warfare. Over the course of the first 72 hours, from February 28 to March 3, kinetic blows and digital disruptions merged in ways that revealed both the strengths and vulnerabilities of actors across the region.  

Throughout this critical period, Cyble Research and Intelligence Labs (CRIL) has been meticulously tracking the movements, attacks, claims, and associated cyber activity between Iran, Israel, and the US, providing real‑time insights into both the kinetic strikes and the evolving threat landscape.  

Prelude to Conflict: Buildup and Diplomatic Gridlock 

In the days leading up to February 28, the Middle East witnessed a massive US military buildup, the largest since the 2003 Iraq invasion. Aircraft carriers, fighter wings, and intelligence assets positioned themselves within striking range of Iran’s borders. At the same time, indirect nuclear negotiations in Geneva appeared, momentarily, to offer a diplomatic pathway, with Iran publicly agreeing to halt enrichment stockpiling under International Atomic Energy Agency (IAEA) supervision. However, distrust and strategic imperatives among the US, Israel, and Tehran rendered the diplomatic exercise insufficient to prevent escalation.  

Day 1: February 28 — Operation Epic Fury 

At approximately 06:27 GMT, the first concerted wave of strikes hit Iran. US‑Israeli forces began a broad assault across more than two dozen provinces, targeting nuclear facilities, IRGC command centers, ballistic missile launchers, and secure compounds tied to the Iranian leadership. The offensive reportedly included the targeted killing of Supreme Leader Ayatollah Ali Khamenei, a moment that marked a profound turning point in the conflict.  

What set the opening apart from traditional air campaigns was its immediate cyber component. For the first time on such a scale, network disruption was planned to coincide with a kinetic impact. Independent monitors observed Iranian internet connectivity collapse to roughly 1–4% of normal levels as cyberattacks crippled state media, government digital services, and military communications. 

Popular local services, including widely used mobile applications and prayer tools, were reportedly compromised to sow confusion and prompt defections, while defaced state news sites delivered messages contradicting official Iranian narratives.  

Before the current situation, MuddyWater, long associated with Iran‑linked cyber campaigns, remained a critical piece of the pre‑existing threat landscape. Alongside other advanced persistent threat (APT) groups — such as APT42 (Charming Kitten), Prince of Persia / Infy, UNC6446, and CRESCENTHARVEST — these campaigns had already been active before February 28, conducting phishing, exploitation of public servers, and information theft targeting Israeli, US, and regional networks.  

While Iran’s domestic internet infrastructure faltered, the US‑Israeli offensive extended psychological operations into Israeli territory. Threatening messages referencing national ID numbers and fuel shortages arrived in civilians’ inboxes, and misinformation campaigns amplified anxieties even as authorities worked to blunt digital interference. 

Day 2: March 1 — Retaliation and the Surge of Hacktivism 

Iran’s kinetic retaliation was swift and forceful. From March 1 onward, waves of ballistic missiles and drones launched at Israel, Gulf Cooperation Council (GCC) states, and US military bases reinforced that Tehran’s response would not be limited to symbolic posturing. The UAE alone intercepted hundreds of projectiles, resulting in civilian casualties and infrastructure damage, including at Dubai’s international airport and an AWS cloud data center within its mec1‑az2 availability zone.  

On the cyber front, March 1 started the dramatic expansion of hacktivist activity across the region. More than 70 groups — spanning ideological spectrums and even blending pro‑Iranian and pro‑Russian motivations — activated operations in parallel with state responses. An Electronic Operations Room organized by Iraqi‑aligned hackers, such as Cyber Islamic Resistance / Team 313 began orchestrating distributed denial‑of‑service (DDoS) attacks, website defacements, and theft of credentials across national government portals and key infrastructure systems in Turkey, Poland, and GCC states. 

One of the most technically significant artifacts of March 1 was a malicious RedAlert APK observed by Unit 42 analysts. Designed to mimic Israel’s official missile alert app, this payload was distributed via Hebrew‑language SMS links. Once installed, it collected sensitive device and user information — contacts, SMS logs, IMEI numbers, and email credentials — with encrypted exfiltration mechanisms and anti‑analysis protections, providing a rare glimpse of tradecraft resembling state‑level cyber operations at a time when Iranian domestic internet access was severely limited.  

Beyond MuddyWater and other established APTs, opportunistic cybercriminals exploited the chaos through social engineering campaigns in the UAE.  

Day 3: March 2–3 — Strikes, Blackouts, and Enduring Hybrid Threats 

The kinetic campaign broadened on March 2 with the destruction of the IRGC’s Malek‑Ashtar headquarters in Tehran. By March 3, Israeli forces had struck Iran’s state broadcaster, further constraining Tehran’s ability to manage domestic information and cyber operations. The extended internet blackout — persisting well into the third day — continued to isolate Iranian networks, allowing external campaigns to operate with limited interference.  

Several digital fronts emerged during this period: 

• Hacktivist and Propaganda Operations: Groups such as Handala Hack Team claimed exfiltration of terabytes of financial data; others like DieNet and OverFlame targeted GCC critical infrastructure portals and governmental systems in coordinated disruptive campaigns. 

• Pro‑Russian Opportunistic Convergence: Entities, including NoName057(16) and Russian Legion, shifted their focus from Ukraine‑related operations to anti‑Israel actions supportive of Iran, albeit with mixed credibility. 

• Cybercrime Opportunism: The blend of hacktivism and ransomware was exemplified by groups like INC Ransomware, which targeted industrial entities and combined extortion‑style tactics with ideological messaging. 

Throughout March 1–3, analysts noted that most observed cyber activity fell into the realm of DDoS attacks, exposed CCTV feeds, and information operations rather than destructive intrusions into industrial control systems — although unverified claims of SCADA manipulation circulated widely in pro‑Iranian forums.  

Broader Regional and Strategic Implications 

The first 72 hours of Operation Epic Fury reveal several critical insights about modern conflict dynamics in the Middle East: 

1. Cyber as a Co‑Equal Domain: Cyber operations were planned and executed in lockstep with kinetic strikes, demonstrating that modern warfare no longer segregates digital and physical arenas. 

2. Hacktivist Amplification: With over 70 groups active within days, the hacktivist ecosystem has become a force multiplier of psychological and disruptive operations that can transcend national borders. 

3. Opportunistic Exploitation: As seen in social engineering and ransomware campaigns, broader conflict can catalyze financially motivated cybercrime that piggybacks on geopolitical uncertainty. 

These dynamics suggest that defenders in the region — from government CERTs to multinational enterprises — must maintain heightened vigilance across both technical and psychological threat vectors, with particular emphasis on credential harvesting, DDoS mitigation, and proactive monitoring of emerging malware campaigns. 

Conclusion 

The events from February 28 to March 3 highlight that the US‑Israeli offensive against Iran — launched as Operation Epic Fury — is not merely a military confrontation but a hybrid engagement across kinetic, cyber, and informational domains. While Iran’s internet infrastructure remains degraded, sophisticated pre‑positioned capabilities could still be activated in the coming weeks, particularly if connectivity is restored. Meanwhile, the hacktivist theatre continues to grow in both volume and geographic scope, even as the technical sophistication of most operations remains limited. 

In this environment, security practitioners and strategic planners must be prepared for adaptive threat behavior that blends political motivations with opportunistic cybercrime — a reality that defines the 21st‑century battlespace in the Middle East and beyond. 

References: 

• https://unit42.paloaltonetworks.com/iranian-cyberattacks-2026/ 

• https://www.sophos.com/en-us/blog/cyber-advisory-increased-cyber-risk-amid-u-s-israel-iran-escalation 

• https://www.ncsc.gov.uk/news/ncsc-advises-uk-organisations-take-action-following-conflict-in-middle-east 

• https://www.cybersecuritydive.com/news/iran-hackers-threat-level-us-allies/813494/ 

• https://flashpoint.io/blog/escalation-in-the-middle-east-operation-epic-fury/ 

• https://www.anomali.com/blog/cyber-threat-briefing-iran-retaliatory-posture 

• https://blog.checkpoint.com/research/what-defenders-need-to-know-about-irans-cyber-capabilities/ 

• https://www.khaleejtimes.com/uae/dubai-police-warn-scammers-impersonating-government-officials 

The post Middle East on the Brink: Iran-US-Israel Hostilities Trigger Cyber-Kinetic Conflict appeared first on Cyble.

The Middle East has entered a critical tipping point, as tensions between Iran, the United States, and Israel escalated into a complex hybrid conflict that blends traditional military operations with cyber and information warfare. The offensive, identified as Operation Epic Fury by the US and Operation Roaring Lion by Israel, demonstrates how modern hostilities can no longer be understood through conventional lenses alone.  Unlike previous confrontations, this campaign combined kinetic strikes, cyber intrusions, psychological operations, and information manipulation into a single, synchronized effort. Cyber capabilities were leveraged as a co-equal domain alongside air and missile strikes, revealing a new level of strategic integration that reshapes the dynamics of regional warfare.   Independent monitoring from Cyble Research and Intelligence Labs (CRIL) highlighted how these combined operations exposed both strengths and vulnerabilities among the actors involved. 

Strategic Build-Up and Diplomatic Limitations 

In the lead-up to the offensive, the United States mobilized its largest Middle East deployment since the 2003 Iraq invasion, positioning aircraft carriers, fighter squadrons, and intelligence assets near Iran’s borders.   Parallel diplomatic initiatives in Geneva offered a fleeting possibility of negotiation, as Tehran agreed to halt nuclear enrichment under IAEA oversight. However, mutual distrust, strategic imperatives, and long-standing hostilities rendered these measures ineffective, creating conditions ripe for Operation Epic Fury and Operation Roaring Lion.

Hybrid Warfare: The Cyber-Kinetic Nexus in the Middle East

The campaign’s defining feature was the integration of cyber operations with kinetic attacks. Iran’s domestic internet infrastructure was reportedly reduced to 1–4% functionality, as state media, government services, and military communications came under sustained digital assault. Popular services, mobile applications, and religious platforms were compromised, while government websites displayed defaced content intended to undermine Tehran’s official narratives.  Pre-existing cyber actors, including MuddyWater, APT42 (Charming Kitten), Prince of Persia/Infy, UNC6446, and CRESCENTHARVEST, amplified the conflict through phishing, data theft, and server exploitation. Simultaneously, psychological operations extended into Israel, delivering threatening messages about fuel shortages and national ID numbers.

Retaliation and Regional Cyber Convergence 

Iran’s response combined missile and drone attacks targeting Israel, Gulf Cooperation Council (GCC) states, and US military bases, causing civilian casualties and infrastructure damage, including at Dubai International Airport and an AWS cloud data center.   Hacktivist groups surged in parallel, with over 70 organizations conducting DDoS attacks, website defacements, and credential theft campaigns across multiple countries. Malicious payloads, such as a RedAlert APK mimicking Israel’s missile alert app, showcased tradecraft usually associated with state-sponsored operations.  Pro-Russian groups like NoName057(16) and Russian Legion opportunistically aligned with Iranian interests, while cybercriminal actors exploited chaos to launch ransomware and social engineering campaigns, demonstrating the convergence of ideological and financial motivations in modern hybrid warfare. 

Lessons and Implications 

The ongoing operations stress several key lessons for the region and global observers: cyber operations now function as coequal with kinetic action; hacktivist networks can act as force multipliers across borders; and opportunistic cybercrime thrives in environments of geopolitical uncertainty. Analysts emphasize the need for continuous vigilance, from credential monitoring and DDoS mitigation to proactive defense against emerging malware campaigns.  Operation Epic Fury and Operation Roaring Lion highlight that the current Middle East conflict extends far beyond conventional warfare. Even as Iran’s networks remain degraded, pre-positioned cyber capabilities and hacktivist activity could sustain prolonged disruption, signaling a persistent and modern threat landscape that will influence regional and global security calculations for months to come.

AWS says drone strikes damaged data center facilities in the UAE and Bahrain, disrupting and degrading dozens of cloud services across the Middle East.

The post AWS Data Centers Hit: Drone Strikes Cripple Cloud appeared first on TechRepublic.

The United States and Israel launched an attack on Iran on Saturday morning, killing Supreme Leader Ayatollah Ali Khamenei as well as several senior regime figures and striking multiple sites across the country. Iran retaliated by firing at targets across the region, including Israel, Bahrain, Qatar, the UAE and other Gulf states. The conflict is ongoing despite no declaration of war by the US Congress. US President Donald Trump initially called for regime change in Iran but has since delivered a mixed message about the aims of “Operation Epic Fury”.

Israel has said it dropped more than 2,000 bombs in the first 30 hours of the war. While the US claims to have struck over 1,000 targets in the first 24 hours, with President Trump stating that “bombs will fall everywhere”. In response, Iran is reported to have launched at least 390 missiles and 830 drones in the first two days.
Bellingcat has been monitoring strikes across the region, including those that caused civilian harm, and identified a wide variety of weapons have been used so far, including missiles and drones.

US-Made Weapons and Tomahawks Launched

The US reported that some of the first weapons they launched were Tomahawk missiles. Footage from the US McFaul also showed Tomahawks being launched.

There is also reporting that a new variant of the Tomahawk was used in these strikes.

Imagery of many other different munitions used by the US, Israel and Iran have appeared on social media. 

This article covers some of the munitions Bellingcat has seen imagery of as the war enters its fourth day.

Many of the weapons used so far have also been deployed in other recent US conflicts, including the 12-day Israel-Iran war, and US strikes in Yemen and Venezuela. 

The US is the major supplier of arms to allies in the region, including for Israel, Kuwait, Qatar, UAE, and Jordan.

On Sunday, the US Department Of Defence (DOD) published photos showing weapons being prepared for loading on aircrafts, including the MK-80 series of bombs like MK-82 500-pound bombs, and BLU-109 2,000-pound ‘bunker busters’ equipped with Joint Direct Attack Munition (JDAM) bomb guidance kits.

The DOD has also released several photos showing the C variants of the AGM-154 Joint Standoff Weapon (JSOW). As documented by the Open Source Munitions Portal, this weapon has been used recently by the US in Yemen and Venezuela.

The DOD also released a slideshow showing images from the first 24 hours of the war, including an image showing the first combat use of the Precision Strike Missile. The DOD further released a list of some equipment used, including the THAAD ballistic missile defense system.

Many of the weapons deployed by the US have also been used by Israel. This includes the MK-80 series of bombs, BLU-109 bombs and Joint Direct Attack Munition (JDAM) bomb guidance kits.

Israel also produces some of its own munitions, which they released video or photos of since the start of the conflict, including MK-83 1,000-pound bombs equipped with Israeli SPICE-1000 bomb guidance kits.

Israel also produces RAMPAGE missiles, visible in the image below. 

On Sunday, the DOD said they had used the Low-cost Unmanned Combat Attack System (LUCAS) one-way attack drones in strikes. The LUCAS drone is a US copy of the Iranian Shahed one-way attack drone.

A video of a crashed LUCAS drone has subsequently appeared online, reportedly in Iraq. 

While Bellingcat could not geolocate this video, then men seen in the footage can be heard speaking Arabic while US CENTCOM has said that this is the first time they have used this drone in combat.

Local Iraqi residents are taking the newly deployed, nearly intact American LUCAS drone for themselves. pic.twitter.com/fbx411iAYU

— Special Kherson Cat (@bayraktar_1love) March 2, 2026

A video shows a LUCAS drone that allegedly crashed in Iraq.

Iranian Attacks

Iran has retaliated by firing one-way attack drones, including Shahed variants, and missiles at Israel, and US-bases in various countries across the region, including UAE, Qatar, Kuwait, Jordan and Iraq. 

Iranian Shahed drones have hit civilian buildings in the Gulf, as well as US military bases.

Palm Jumeirah in Dubai was attacked by Shahed kamikaze drones.

[image or embed]

— Special Kherson Cat (@specialkhersoncat.bsky.social) 28 February 2026 at 15:37

A Shahed drone crashes into a hotel in Dubai on Feb. 28.

In Bahrain, a Shahed was seen crashing into a residential building on Feb. 28.

Virtually a first person view of the Iranian drone hitting the high-rise building in Manamah, Bahrain.

[image or embed]

— (((Tendar))) (@tendar.bsky.social) 28 February 2026 at 18:57

A Feb. 28. video shows a Shahed drone hitting a residential tower in Bahrain.

Many missiles have a booster, a rocket motor that detaches from the missile after it is expended. These boosters fall to the ground under the flight path of the missile. 

Bellingcat verified that Iranian missile boosters have fallen in nearby countries caught in the crossfire, including Qatar and Jordan (see below post geolocated to Al-Hashmi St. in Irbid, Jordan), while some Israeli boosters have reportedly fallen in Iraq.

اهلنا في اربد الله يحميكم pic.twitter.com/LvHWgicE4F

— فواز الذياب (@FawazElziyab) February 28, 2026

A Feb. 28. post shows an Iranian ballistic missile booster that fell on Al-Hashmi St. in Irbid, Jordan.

Iranian Missiles Intercepted

The US and Israel, as well as several Gulf countries, have fired missiles, intended to destroy Iranian missiles or drones in the air before they reach their targets. Many Iranian weapons have been intercepted, but others have successfully hit, including in a strike on a US command post in Kuwait, killing six US troops.  

Most ballistic missile interceptors are “hit-to-kill” where they are designed to destroy missiles by the impact. These interceptors have their own components that fall to the ground, as well as the debris from interceptions.

Remnants of Patriot Interceptor missiles, which are operated by the US and several Gulf countries, have been seen, and countries including the UAE have reported they have intercepted missiles. The UAE has claimed that 165 missiles and 541 drones were fired at the country, most were intercepted.  

A Sea of Unverified Images and Misidentification of Munitions

Many close-up images of munition debris have been posted on social media over recent days which are difficult to geolocate. While we have not been able to verify the location of these munitions, we used reverse image search tools to verify they had not been posted online prior to the current conflict. The munition remnants are also consistent with those used by the US, Israel and Iran. But as we cannot geolocate or chronolocate them yet, we cannot fully verify them. Many of these images have been posted with false claims about the object and who fired it.

Despite Bellingcat being unable to fully verify them, we are including a selection of them with accurate identifications, due to the likelihood that more images of these same objects will continue to appear online as the war continues.

One example of incorrectly identified munitions, is the below picture of an aircraft’s external fuel tank, or drop tank that was posted on Telegram on March 1 alongside the claim that it is an Israeli missile.

A Mar. 1. image shows a drop tank from an Israeli jet reportedly found in Anbar, Iraq. Source: NAYA.

Drop tanks are used on jets to extend the range and are jettisoned after use, resulting in these tanks falling to the ground. These tanks have been mistaken for missile parts in previous conflicts.

Despite Iran’s prevalent use of missiles, not all missile boosters are Iranian. On February 28 missile boosters from Israeli air-launched ballistic missiles were reportedly found just east of Tikrit, Iraq. The below image shows the booster from Israel’s Blue Sparrow series, and can be matched to images previously identified and posted on the likes of the Open Source Munitions Portal.

A short while ago, a missile landed near Duraji village in the Dauda area of the Khurmatu district.#Isreal #Iran pic.twitter.com/qzZLNUgekD

— Sarwan Wllatzheri (@SarwanBarzani_) February 28, 2026

A Feb. 28. post shows an Israeli Blue Sparrow series missile booster, reportedly found in Duraji, Iraq.

Additionally, unexploded WDU-36/B warheads from Tomahawk missiles were reportedly found –, one in Kirkuk, Iraq and one found near Jablah, Syria. Tomahawk warheads and other remnants are frequently misidentified, often as drones.

These titanium cased warheads comprise a small part of the much larger Tomahawk missile, and have been found intact in numerous countries when the warhead has failed to explode, as seen in images shared on the Open Source Munitions Portal. 

Unexploded Tomahawk warheads from strikes in other conflicts have also been identified by the Open Source Munitions Portal .

Remnants of an Israeli Arrow 2 interceptor missile were posted online, falsely identified as an Iranian missile, and were allegedly found in eastern Syria.  These images could again be matched to those found from previous conflicts on the Open Source Munitions Portal.

An Iranian missile fell in Al-Shoula area, south of DeirEzzor eastern Syria!. pic.twitter.com/TsWVuda2nf

— Omar Abu Layla (@OALD24) March 1, 2026

A Israeli Arrow 2 interceptor missile falsely identified as as an Iranian missile in a post on X.

An Ancient US Munition Used by Iran

One photo of a remnant reportedly found in Ahvaz, Iran, included a false claim that it was a US ATACMS missile. Bellingcat was able to confirm the image does not match ATACMS construction by comparing it to imagery of that munition. We have as yet been unable to confirm if it was indeed located in Ahvaz, Iran – although we were able to identify the munition.

U.S. ATACMS tactical ballistic missile remains found in Ahvaz, Iran.@Osinttechnical pic.twitter.com/plytSUI4w6

— Open Source Intel (@Osint613) March 1, 2026

An actuator section of a MIM-23 HAWK missile, falsely identified by the post above as an ATACMS missile.

The markings on the remnant include an  “FSN” or federal stock number, that can be looked up to identify the item. The FSN was replaced by the national stock number (NSN) in 1974, meaning this missile was produced prior to 1974.

Bellingcat looked up the  FSN/NSN (1410002343266) which corresponds with the US manufactured MIM-23B HAWK, an air defence missile. 

There are many other US, Israeli and Iranian munitions that may have been used in the current conflict, but images have not yet appeared on social media.

With fresh strikes carried out overnight/ early Tuesday and President Trump saying that “likely more” US troops will die, the conflict continues to escalate and shows no sign of ceasing in the days ahead. And despite the death of Ayatollah Ali Khamenei the Iranian regime has vowed revenge and continued strikes against Israel, the US and their Gulf allies.

---

Bellingcat’s Carlos Gonzales, Jake Godin and Felix Matteo Lommerse contributed research to this article. Anisa Shabir from Bellingcat’s Volunteer Community also contributed to this piece.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

The post “Bombs will fall Everywhere”: The American, Israeli and Iranian Weapons Being Deployed in Middle East appeared first on bellingcat.

US president Donald Trump said a “major combat operation” against Iran had begun as he called for the country’s government to be overthrown.

A shipwreck in India, an ammunition seizure in Senegal, and a raid on an oil tanker in Malaysia – all three incidents involve ageing vessels, operating with false papers and one recurring figure: Captain Suniel Kumar Sharma.

For over a decade, Sharma has been condemned by the governments of Dominica, Guyana, Samoa, the Federated States of Micronesia and Eswatini, as well as the UN International Maritime Organisation (IMO), for issuing fraudulent paperwork to vessels, including false flag certificates.

In a recent interview with the Financial Times, Sharma said his most prominent flag registry, the International Maritime Safety Agency of Guyana (IMSAG), was no longer operational. However, a Bellingcat investigation has found certificates issued by IMSAG as recently as December 2025. In the same interview, Sharma denied setting up any more registries. Yet Bellingcat has found evidence of a newly launched website linked to Sharma offering flag registration in Nicaragua.

In June 2020, a typhoon off the Indian coast forced the 38-year-old oil tanker, MT Basra Star (IMO 8515817), to run aground. Despite an insurance inspector’s report recommending her immediate demolition, the vessel remained for five years, rusting away on the beach, until she was finally scrapped in January this year.

The insurance report states Basra Star was sailing under a Samoan flag and its classification society (the company that certifies the vessel as seaworthy) was Ascent Navals.   

Two years before MT Basra Star ran aground, the Samoan government and the IMO issued a warning about a fraudulent company called Ascent Navals, and its director, Captain Suniel Kumar Sharma, for appearing to operate on behalf of Samoa, but without official authorisation.

By sailing under a false flag (Samoa False) and a fraudulent classification society (Ascent Navals), when the worst-case scenario did occur, no jurisdiction (flag state) was legally responsible for the marooned ship.

Bellingcat contacted the vessel’s owners, Shat Al Arab Marine Supply LLC, the insurance surveyors, Uday Bhogate & Associates, and Ascent Navals and its director, Suniel Kumar Sharma. None responded to requests for comment.

Nearly two years after Basra Star was shipwrecked, another ageing vessel, Eolika (IMO 8214968), was found operating under a false flag while laden with illicit cargo. At the port of Dakar, Senegalese customs officers boarded the 39-year-old cargo ship and discovered three concealed containers of ammunition, reportedly worth US$5.2 million. Eolika was flying a false Guyana flag. 

In an open letter, the IMO, together with the Guyana authorities, denounced the flag under which Eolika was sailing as false. They warned of a fraudulent company, the International Maritime Safety Agency of Guyana (IMSAG), for flagging vessels without authorisation from any flag state. Guyana’s police force said it would investigate “this rogue enterprise led by Captain Suniel Kumar”, together with Interpol.  

There is no suggestion that Sharma or IMSAG took part in the transport of illicit goods. The IMO warning was issued in response to IMSAG supplying false paperwork, which then enables vessels to operate without oversight. Flying a false flag for a registry that doesn’t exist voids any insurance, risks crew safety and threatens environmental harm, as seen with the Basra Star.  

But it’s not just Sharma’s companies supplying false papers. Last year, maritime experts at Windward identified 285 international tankers falsely flagged by 18 different fraudulent registries. The majority were sanctioned vessels, which typically seek out false flags to evade restrictions. However, according to Lloyd’s List Intelligence, it was Guyana’s fraudulent registry which became the first port of call for sanctioned tankers looking to hop flags.

Seized off the coast of Malaysia earlier this year, the sanctioned tanker Nora (IMO 9237539) switched to a false Guyana flag issued by IMSAG on February 1, 2025. Nora and a second sanctioned tanker, Rcelebra (IMO 9286073), were caught by the Malaysian Maritime Enforcement Agency (MMEA) engaged in an unauthorised ship-to-ship transfer.

Both captains and 53 members of the crew were detained. The cargo of crude oil was valued at more than RM512 million (US$130 million), according to the MMEA. 

However, within days, both tankers were released. Fined the maximum penalty of RM300,000 (US$76,000) for an unauthorised ship-to-ship transfer, the MMEA acted to enforce Malaysia’s environmental and maritime safety laws, but not International and UN sanctions. Asked if this was within its remit, the MMEA did not respond to our request. 

There is no indication that Sharma or IMSAG knowingly issued flags to criminal actors. But by providing false paperwork, the IMO warn that fraudulent flag registries are enabling high-risk vessels to continue operating. 

The promise of investment and the signing of an MoU

Crucial to understanding how IMSAG has continued to operate as a fraudulent registry for so long is that it was once legitimate. 

Back in 2021, Guyanan media described how IMSAG was making investments of US$35 million, creating hundreds of jobs, and constructing a state-of-the-art training facility – all presented as a way to grow Guyana’s maritime industry. 

Sharma also signed a Memorandum of Understanding (MoU) with Guyana’s Maritime Ministry. But less than six months later, Guyana quietly terminated all arrangements with Sharma and his companies.

Whilst the MoU was in effect, IMSAG had served as Guyana’s official international ship registry. The domain imsag.org was used to register and flag vessels on its behalf. But after the MoU was terminated, instead of shutting the company down, IMSAG continued to operate without Guyana’s authorisation. A redacted version of the MoU is still live and being promoted on IMSAG’s website. 

In a recent interview with the Financial Times, Sharma confirmed he had set up a ship registry in Guyana, but said it had been “discontinued” after the authorities withdrew consent. He also said the domain imsag.org was “not operational just informative”.

Bellingcat recently downloaded 230 vessel certificates for 87 ships from imsag.org, including the sanctioned tanker recently seized by the Malaysian authorities, Nora. 

Counter to Sharma’s claims that IMSAG was no longer operational, all 230 certificates found by Bellingcat were issued well after the MoU was terminated in March 2021, including some as recently as December 2025. Of the 87 certified vessels 63 were oil tankers, with an average age of 24 years. Diana 1 (IMO 9212229), for example – a 26-year-old oil tanker last seen in Libya – was issued a certificate by IMSAG on June 26 2025. 

According to Equasis data, Diana 1 hopped to a false Guyana flag on July 1 2025. 

Neither Sharma nor IMSAG responded to our request for comment regarding our findings that IMSAG had continued issuing certificates as recently as December 2025, despite Guyana having terminated the MoU and withdrawn its authorisation.

For a full list of the 87 vessels, including certificates and details of our methods, click below to expand:

See full certificate list and methodology

The table below lists all 87 vessels and 230 certificates that Bellingcat found records for on imsag.org. Hover over each certificate for details, or click to see an archived screenshot. Each vessel’s flag history has been pulled from the maritime database Equasis to compare when the vessels switched to the Guyana flag and when they were issued a certificate from IMSAG.

Methods:

The IMSAG website allowed users to search using either a “Certificate Number” or an “Official Number.” The search returned information about a vessel, including the dates on which certificates were issued.  While these certificate numbers were not publicly disclosed, Bellingcat found a seafarer certificate via a Google search for “site:imsag.org filetype:pdf”, which locates PDFs hosted on IMSAG’s website. By changing the URL to look for ship certificates instead, imsag.org returned a vessel certificate for the oil tanker, Tranquilus.

Bellingcat then tested sequential variations of certificate and official numbers, returning 230 certificates issued by IMSAG. As not all certificate numbers were sequential, this index represents only a partial view of IMSAG’s recent activity.

Expanding Operations in Nicaragua

In Sharma’s interview with the Financial Times, he denied he was setting up any more registries and said he had left the maritime sector entirely. Yet Bellingcat has found evidence of a new registry with links to Sharma that appears to be offering flag registration in Nicaragua. 

In July 2025, the domain niataregister.com was launched, promoting the Nicaragua International Aquatica Transportation Administration (NIATA).

The website is active. Bellingcat found a certificate issued as recently as February 2 for the sanctioned tanker and member of the shadow fleet, Al Jafzia (IMO 9171498, sanctioned under the name Chil 1).

According to maritime tracking data, on February 6, while sailing under a false Aruba flag, the Al Jafzia was detained by the Indian Coast Guard for an illicit ship-to-ship transfer of Iranian oil. On February 11, the vessel began broadcasting under a Nicaraguan flag, listing its home port as Corinto, Nicaragua’s largest port. The MMSI number can be seen in the certificate below.  

Despite multiple requests, the Nicaraguan authorities did not respond to our questions as to whether they had heard of NIATA or had any official partnership with the company. 

According to the IMO’s GISIS database, Nicaragua has not approved any organisation to issue flags on its behalf. The IMO also confirmed directly to Bellingcat that Nicaragua had provided no further information beyond what was visible in GISIS at the time of publication.

Bellingcat downloaded all publicly available forms from NIATA’s website. Analysing document metadata revealed the creator of the documents as ‘Oceaniek Technologies’.

Navigating to the Oceaniek Technologies homepage (shown below), under the headline ‘Our Products’ 11 companies were promoted in a looping carousel up until August of last year. It now features only five, spanning a wide range of industries, including a cricket league, a hospital and streaming services.

The managing director of Oceanik Technologies, according to his own LinkedIn, is Suniel Sharma. Sharma has also been photographed by local Indian media, cited as the “MD of Oceanik Technologies”.

Also among the 11 companies promoted up until August of last year were the Nautilus Times and Nautilus Register.

Promoting vessel classification services, Nautilus Register, appears as an entity of interest in OpenSanctions due to its ties with several sanctioned vessels, including members of the shadow fleet. Sharma’s own LinkedIn lists him as the Director General of the Nautilus Register. 

Bellingcat confirmed nautilusregister.net is still active, issuing classification certificates as recently as January 2026 (shown below). The IMO told Bellingcat that Nautilus Register is not listed as a recognised organisation in their database, GISIS.

A search for the second company, Nautilus Times, led to a website offering dozens of training courses, from cadetship to firefighting, as well as competency training.

Competency training is a requirement for all seafarers. Crew members may attend a course in any jurisdiction, but it’s then up to the flag state (the country in which the vessel is registered) as to whether that training is recognised.

According to the Nautilus Times website, a crew member can enrol in any one of six jurisdictions, as shown below, including Guyana and Nicaragua.

After contacting all six jurisdictions, the official Maritime Administration Department (MARAD) of Guyana confirmed that Nautilus Times was not authorised to issue certificates to seafarers on their behalf. They reiterated that they had no relationship with Nautilus Times or Sharma. St Maarten has previously said that it does not have an international flag registry and therefore does not issue competency certificates. No other jurisdictions replied to our request. 

Bellingcat contacted both the Nautilus Times and Sharma to ask why the site was advertising courses on behalf of Guyana and St Maarten without their authorisation. Neither replied to our request for comment.

Finally, two more companies embedded in the carousel on Oceaniek Technologies’ homepage,  but deleted after August 2025, were the MSTA Registry and Aruba Maritime.

The MSTA Registry was cited in a warning issued by St Maarten and the IMO in May 2025 for issuing false flags to vessels under the guise of St. Maarten. Aruba Maritime was sanctioned by the European Union in October 2025 for fraudulently issuing oil tankers with false Aruba flags. 

Neither Oceaniek Technologies nor Sharma responded to our request for comment regarding the nature of these companies’ connection to Oceaniek Technologies. 

As sanction enforcements continue to expand, so too will the number of vessels seeking illegitimate paperwork from fraudulent registries such as IMSAG. Despite criminal charges being filed, warnings being issued, and investigations being published, Sharma’s operation continues – now seemingly having expanded into Nicaragua and with the apparent formation of a larger network, Oceaniek Technologies. 

---

Merel Zoet and Claire Press contributed to this report.

Bellingcat is a non-profit and the ability to carry out our work depends on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here and Mastodon here.

The post Shipwrecks, Sham Papers and False Flags: Tracking the Company Behind It All appeared first on bellingcat.

To stay up to date on our latest investigations, join Bellingcat’s WhatsApp channel here

On the night of Jan. 7 this year, three 250-pound bombs smashed into an apartment block in the Al Tuffah neighbourhood of northern Gaza. Footage of the aftermath shows walls collapsed, rubble piled up and blackened household items scattered across the scene.

Although a ceasefire has been in effect since October, and a Board of Peace led by US President Donald Trump has been announced to begin phase two of that process, Israel has continued to conduct strikes within Gaza

The IDF claimed they targeted a senior Hamas operative in response to a violation of the ceasefire agreement in the Jan. 7 attack. 

Two people were reported to have been killed.

While the strike was an Israeli operation, among the debris were munition remnants of at least three US-made GBU-39 Small Diameter Bombs, including one that failed to explode.

American-made munitions like these have played a significant role in Israel’s operations in Gaza. 

The US has provided billions of dollars worth of military aid to Israel over the years, and has enacted legislation providing at least US$16.3 billion in direct military aid since the most recent war began. In the first few months of the Trump Administration nearly $12 billion in major weapon sales to Israel were approved with deliveries scheduled to take years to complete.

However, human rights groups like Amnesty International and Human Rights Watch have said that US-made weapons have been used in Gaza in ways that have likely violated international law. Multiple international media reports have also identified individual instances of civilian harm likely caused by US weaponry deployed by Israel in Gaza.

A 2024 State Department report, completed during the administration of former President Joe Biden, even stated that due to Israel’s “significant reliance on US-made defence articles it is reasonable to assess” that they have been used in “instances inconsistent with its IHL [International Humanitarian Law] obligations or with established best practices for mitigating civilian harm” — although Israel says it operates within international law and seeks to mitigate civilian harm while aiming to dismantle Hamas’ military capabilities. 

Yet the full extent of civilian harm in Gaza caused by the use of US-produced weapons remains unclear. 

Foreign media are not allowed into Gaza and the documentation of events there has relied heavily on social media footage and the work of local journalists, many of whom have been killed in Israeli air or ground strikes while carrying out their work.

Collating Incidents

Bellingcat has collated scores of incidents like the Jan. 7 strike in Al Tuffah where US-produced munitions have been found in the aftermath of Israeli strikes.

This analysis utilises publicly available media footage and identifies at least 79 specific cases, many of which caused death and damage to civilian infrastructure such as schools, homes and healthcare infrastructure.

While revealing, it is important to note that the data comes with some significant caveats and limitations that must be acknowledged before exploring it.

Gaza has been pummelled since the Hamas attacks of Oct. 7, 2023, when more than 1,200 Israelis were killed and hundreds more kidnapped. 

In response, Israel is reported to have deployed 30,000 munitions into Gaza in the first seven weeks of the conflict alone. The Israeli Airforce has also bombed over 100 different targets in Gaza in a single day multiple times.

This dataset – which details cases where US-made munition remnants have been found and evidence of their use published in media or posted to social media – therefore only captures a small fraction of the overall incidents over more than two years of war.

Furthermore, Israel and the US both produce some of the same munitions, such as the MK-80 series of bombs. The US supply of this series, especially the 2,000-pound MK-84 of which over 14,000 have reportedly been delivered since Oct. 7 2023, have been central to calls for the suspension of US arms transfers to Israel due to their destructive potential. 

But because Israel also makes these bombs domestically the country of origin cannot be definitively identified without specific remnants that show either the lot number, indicating the manufacturer, or other identifying information.

As a result a decision was made to try and track the use of three specific munitions that are made solely in the US and which Israel does not domestically produce. This, again, significantly reduced the number of incidents analysed. 

These munitions were Hellfire missiles, GBU-39 Small Diameter Bombs and Joint Direct Attack Munition (JDAM) bomb guidance kits. While this analysis does not track MK-80 series bombs, the JDAM kit is one of several guidance kits that can attach to bombs like the MK-84 but which is only produced by the US. 

The full dataset can be found here. The munition identifications were reviewed by Frederic Gras, an independent Explosive Remnants of War (ERW) Expert and Consultant.

Despite all of the above caveats and limitations, the analysis recorded 79 geolocated incidents where remnants of these three models of US-made munitions were either found in the aftermath of a strike or were captured in visual imagery in the moments before impact.

Beyond the 79 cases analysed and included in the dataset, other US-made munitions were identified in a further 26 cases, although it was not possible to geolocate the remnants or strikes prior to publication. It may be possible to geolocate the outstanding incidents in time. Bellingcat is, therefore, including these incidents in the dataset but notes further work is required for them. 

Many of the geolocations in the dataset were initially posted publicly by independent geolocators, or volunteers from the GeoConfirmed community, including Anno Nemo, Abu Location, fdov, Chris Osieck, Zvi Adler and Will Cobb. These geolocations were independently checked and verified by Bellingcat.

For the 79 incidents it was possible to geolocate, Bellingcat sought to compile reports of civilian harm. Yet given the lack of access afforded to international observers it was not possible to independently verify each of these reports of casualties or fatalities.

The reports, many of which cite health authorities in Gaza, detailed that at least 744 people were killed in these 79 strikes, including at least 78 women and 175 children. When reports offered a range for the number killed, or number of women and children killed, Bellingcat used the lower end of the estimate. 

Israel rarely provides estimates for civilian casualties from their strikes. It has also claimed that the Gaza Ministry of Health has exaggerated death tolls after specific strikes. Analysing previous public reporting of each incident in the dataset, Bellingcat found that the IDF had claimed at least 69 people that were reported killed in these attacks were militants belonging to Hamas or other factions. In one strike, where at least 33 people were reported killed, the IDF claimed to have targeted “dozens” of Hamas members, releasing the names of 17 people they said were part of Hamas. 

Bellingcat asked the IDF if they could provide a total for the number of people killed in the attacks listed in the dataset or for any specific strikes but they did not provide a figure. A spokesperson for the IDF provided information for eight strikes within the dataset that it said sought to hit “terrorist targets”. Bellingcat has noted this response beside each incident in the dataset.

The spokesperson added that Israel “strikes military targets and objectives in accordance with international law and takes all feasible measures to mitigate harm to civilians and civilian structures as much as possible.”

The Gaza Ministry of Health has reported that over 70,000 Palestinians have been killed in the conflict. While Israel has long disputed those casualty figures, Israeli media recently cited anonymous Israeli Defence Force (IDF) sources who said they believed them to be largely accurate. Israel has claimed to have killed about 25,000 militants in Gaza. 

Attacks on Schools

Attacks on schools, mosques, shelters and residences are all included in the dataset. In total, 28 strikes on schools using US made munitions were identified. GBU-39 bomb remnants were found at the site of 20 of these strikes. Most of these took place before the ceasefire of January 2025.

For example, the Khadija school in Deir Al Balah was targeted in three rounds of airstrikes on July 27, 2024 that used both GBU-39 bombs and MK-80 series bombs equipped with JDAM kits. Satellite imagery before and after the strike showed significant damage to the facility.

Video from the ground provided more detail, showing that the first round of airstrikes targeted five different areas of the school complex.

The unexploded bomb body of a GBU-39 was found inside the school, while the fuzewell from a GBU-39 bomb that exploded was photographed near the destroyed gate structure.

An evacuation notice was then reportedly issued, and two buildings on the eastern side of the complex were targeted with larger bombs, leveling the buildings there. An additional evacuation notice was reportedly issued before a third strike. 

A video of the third strike shows at least six people, including a child, visible within approximately 55 meters of where a bomb equipped with a US-made JDAM kit hit one of the already collapsed buildings on the eastern side of the complex.

These three strikes killed at least 30 people, including 15 children and eight women, according to reports collated by Airwars. At least 100 were injured, according to the same reports. Most people were reportedly harmed in the initial strikes, according to the UN Office of the High Commissioner for Human Rights.

The United Nations reported at the end of February 2025 that 403 of 564 school buildings in Gaza had been “directly hit” in some manner, either by airstrikes or by other munitions. School buildings are often used as shelters. However, Israel has claimed in some instances that they were being used as Hamas command centres.

After the war resumed in March 2025, recorded strikes on schools generally appeared to use Israeli-made munitions. Only two strikes on schools since then were found to have used US made munitions – a May 2025 attack on the Fahmy Al Jarjawi school with at least three US-made GBU-39 bombs that killed 36 people, according to hospitals in Gaza, and a July 2025 strike on Cairo Basic School where five people were reported killed and where remnants of a Hellfire missile was found.

While the dataset shows no other attacks on schools using US munitions after this period, it is important to note that there may have been other instances where US-made munitions were used in such circumstances but which were not recorded.

Strikes on Healthcare Facilities

Two strikes using US-made munitions to directly target medical facilities were identified in this analysis. A Hellfire missile was used in a June 2024 strike on a health clinic in Gaza City that killed Hani al-Jafarawi, the director of ambulance and emergency services in Gaza. However, the IDF claimed the strike had killed “the terrorist Muhammad Salah, who was responsible for projects and development in Hamas’ Weapons Manufacturing Headquarters”.

The Gaza Civil Defence Headquarters in Al Daraj, Gaza City, was also targeted with a US-made GBU-39 bomb in September 2024. The bomb penetrated multiple floors but failed to explode, causing injuries but no deaths.

Five instances of US-made munitions being used for strikes near medical facilities were also identified. Four of these strikes used Hellfire missiles to target tents within approximately 150 meters of the Al Aqsa Martyr’s Hospital Main Complex in Deir Al Balah.

The fifth strike used a US JDAM likely attached to a MK-82 500-pound bomb to target the Al Aqsa Mosque across the street from the hospital, approximately 50 meters away from the main hospital complex. This strike killed 26 people, according to the Gaza Ministry of Health. 

A US Marine Corps manual on Close Air Support states that a MK-82 bomb delivered within 425 meters is considered “danger close”, with a bomb delivered within 250 meters being 100 times more dangerous than the minimum “danger close” standard.

Evacuation Strike Notices

Twenty-six strikes were identified where US munitions were used to target buildings including homes, schools and mosques after an evacuation notice was issued by the IDF. In 23 of these strikes there was no reported harm. However, there was significant harm recorded in others even with evacuation notices. 

Evacuation notices are notifications that provide advance warning of strikes and can be made on social media or sent to people’s phones. These notices often provide journalists on the ground time to set up cameras to record the incoming strikes. Such videos are occasionally of high enough quality to identify the bomb guidance kit attached as JDAMs kit as they fall, as can be seen in the video below.

لحظة قصف مسجد الألباني في مدينة خانيونس بصاروخين من طيران الحربي .
The moment the Al-Albani Mosque in Khan Younis
was bombed with two missiles by warplanes.

: Abdallah Alattar / Anadoluimages
1 أغسطس 2025 pic.twitter.com/U3Tad0veA6

— عبدالله العطار abdallah alattar (@abdallahatar) August 1, 2025

By Sept. 17, 2025 Israel said it had destroyed 25 high-rise buildings in preparation for their assault on Gaza City. Bellingcat was able to identify that at least seven high-rise buildings in Gaza City, including Al Soussi Tower, Al Roya Tower, and Al Roya 2 Tower, were issued evacuation notices then destroyed using MK-80 series bombs with JDAM kits.

The Aybaki Mosque, built in the 13th century, was also hit with MK-80 series bombs with JDAM kit, which the IDF told Bellingcat was a strike targeting the “deputy commander of heavy machine guns unit in Hamas, Khaled Nabil Saleh Shabat”. The IDF has claimed that these tall buildings host Hamas infrastructure, including observation posts and prepared attack positions.

The public warnings posted by the IDF for buildings targeted in Gaza City in September 2025 alerted residents of specific blocks, as well as those in the target building and adjacent tents to leave and head south towards the IDF declared humanitarian zone.

Prior to strikes in Lebanon where the IDF issued evacuation notices, maps were publicly posted requesting civilians evacuate at least 500 meters away. However, a review of public posts by the IDF for evacuation notices in Gaza from September 2025 found no notices that provide a specific evacuation distance.

Bellingcat asked the IDF if the content of evacuation notices sent to people’s phones differ in content from those publicly posted and why evacuation notices in Gaza appeared to not provide a recommended evacuation distance like those issued by the IDF in Lebanon. The IDF told Bellingcat that they issue “clear and detailed advance warnings through multiple channels, including communications published by the IDF Arabic Spokesperson and enables the civilian population to evacuate before strike.”

The distance people are told to evacuate prior to strikes is important as fragments from bombs, or the buildings being targeted, can still kill or injure people hundreds of meters away.

In one strike where an evacuation notice was given before the strike, a four-year-old girl, Razan Hamdiye, was reported killed. One person was also reported killed in the strike on the AlRoya tower.

After the airstrike targeting the Harmony Tower, a graphic video captured by the Anadolu Agency showed a group of people about 120 meters away had been either killed or injured by the strike, despite the evacuation notice.

US-made munitions have also been used in other IDF strikes, including one which reportedly killed the leader of Hamas’ Military Wing, Mohammed Deif. At least 90 people were reported killed in this attack and US-made JDAM remnants recovered. US munitions were also used in the September 2025 strike that reportedly killed Hamas Spokesman, “Abu Obayda” and at least six other people, where remnants of US-made GBU-39 bombs were found.

American-made munitions were also used alongside other unidentified munitions in the June 2024 IDF hostage rescue operation in Nuseirat, where 274 people were reportedly killed. These 274 deaths are not included in the 744 people reported killed in the incidents contained within the dataset due to the inability to identify the other weapons used in at least 13 strikes that occurred during the operation.

Bellingcat reached out to the IDF, the US Department of State, and the US Department of Defense before publishing this story. Bellingcat also asked the primary contractors for these munitions, Boeing and Lockheed Martin, about whether they track how their products are used in Gaza.

Boeing, which manufactures the GBU-39 bomb and JDAM bomb guidance kit did not respond. Neither did Lockheed Martin, which makes the AGM-114 “Hellfire” missile.

The Department of Defense declined to comment.

A spokesperson for the US Department of State said “The US Government is not able to make such determinations” when asked how many civilian deaths could be attributed to the use of US-made weapons in Gaza. 

Bellingcat asked if the State Department held a different assessment than the NSM-20 which was introduced under President Biden and determined that it was reasonable to assess that US-made weapons were used by Israel in instances “inconsistent with its IHL obligations or with established best practices for mitigating civilian harm”. The spokesperson said “NSM-20 is no longer US policy.”

The State Department referred other questions about the use of the munitions highlighted in this article to the Israeli Defence Forces, who told Bellingcat that they do not detail the munitions they employ and that Hamas exploits “civilian infrastructure for terrorist purposes”.

---

Jake Godin and Carlos Gonzales contributed to this report.

Afton Briones, a member of Bellingcat’s Volunteer Community, contributed research to this piece.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here and Mastodon here.

The post Made in the USA: How American-Built Weapons Have Wrought Destruction in Gaza appeared first on bellingcat.

In the early hours of June 13, Israeli missiles slammed into apartment buildings across the Iranian capital, Tehran. 

By morning, it became apparent that nine men Israel said were closely associated with the country’s nuclear programme were dead. 

Videos posted to social media showed buildings in flames and rescue workers sifting through rubble as they looked for survivors.

Dozens of civilians who lived in the same apartment blocks as those targeted also died in the strikes. In one instance, a 14-storey residential tower completely collapsed.

But this was just the start, the opening shots of what Israel dubbed Operation Rising Lion – a 12-day operation targeting Iranian scientists, nuclear sites, security figures and military capabilities.

While Iran sought to fight back, launching missiles and drones at Israel, the damage and death toll inflicted by Israel was far greater.

On day 10 of the operation, the United States joined with Israel, carrying out strikes on nuclear sites at Fordow, Natanz and Isfahan.

Bellingcat worked with FRONTLINE (PBS), The Washington Post and Evident Media to piece together the events of the 12-day war to try and understand the true impact of the strikes on Iran’s nuclear programme. Iran maintains the programme is peaceful but Israel has long suspected that it is designed to develop nuclear weapons.

FRONTLINE filmmakers were given access to Iran, where they visited the sites of some of the strikes and spoke to neighbours and relatives of those who were killed as well as high-ranking Iranian officials.

The Washington Post also spoke to senior intelligence and military sources involved in Operation Rising Lion, and the filmmakers visited Vienna to speak with the International Atomic Energy Agency (IAEA), the organisation that has been responsible for monitoring Iran’s nuclear programme.

Bellingcat, alongside The Washington Post, analysed open source information such as satellite imagery, social media footage, local media coverage, death notices and cemetery records to understand how the attacks on Iranian scientists unfolded as well as analyse the civilian cost of the conflict.

US viewers can watch the full film below.

Full reporting reporting from The Washington Post on this topic can be found here and seen on FRONTLINE’s YouTube channel, at pbs.org/frontline, on PBS stations and in the PBS App.

---

Trevor Ball, Carlos Gonzales, Sebastian Vandermeersch and Eoghan Macguire reported for Bellingcat. Sebastian Walker and Adam Desiderio reported for PBS Frontline. Nilo Tabrizy and Jarrett Ley reported for The Washington Post.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Twitter here and Mastodon here.

The post Investigating the Impact of US-Israeli Strikes on Iran’s Nuclear Programme  appeared first on bellingcat.