Sign up here to receive Bellingcat’s biggest investigations by email as soon as they are published. Become a member and support our work here.

In September, CBS News obtained new images of the aftermath of attacks on US bases in the Middle East from active service members. One told the news channel: “This is major damage to our bases that hasn’t been communicated to the American public. “We’re standing there with our eyes closed getting punched in the face,” they added.

While reports have detailed how Iran used Russian intelligence, including satellite imagery, to identify US troops, ships and aircraft, Bellingcat found that publicly available mapping platforms also reveal detailed and potentially sensitive information about US military bases in the Middle East. 

Google Maps and other online mapping services contain dozens of labels identifying facilities including headquarters, accommodation, gyms and fuel points. Publicly available photographs and videos, including material published by the US military, provide further details about how these facilities are used.

Experts told Bellingcat that such information could have helped inform Iranian targeting decisions by revealing where personnel gather and how bases operate. However, they cautioned that Iran would also have had access to other sources of intelligence. Reporting from Reuters earlier this year also highlighted how US officials believed commercially available location data was being used to target US troops in war zones.

The bases examined by Bellingcat are not secret and have operated for years in a region where US forces maintained a strong sense of security. Joseph Jarnecki, a research fellow at the Royal United Services Institute, said the US had been able to maintain aerial superiority and was understood to have significant air defence capabilities, but that Iran’s missile and drone campaign has undermined both assumptions. 

Iranian strikes have damaged at least 20 US military sites across Qatar, Bahrain, the United Arab Emirates (UAE), Jordan, Kuwait, Iraq and Saudi Arabia since the conflict began in February this year.

Governments can request that Google blur or remove sensitive information from its services and Google publishes data on government requests for content removal.

Bellingcat contacted the US Department of Defense who asked us to reach out to CENTCOM about the details in this story. We also contacted Google. However, we did not receive responses to questions from these respondents before publication.

We examined four of the largest and most heavily affected US military installations by Iran’s missile and drone campaign: Camp Buehring and Camp Arifjan in Kuwait, Muwaffaq Salti Air Base in Jordan and Al Udeid Air Base in Qatar. At each one, we found publicly available Google Maps information providing details about facilities inside the bases and how they are used.

Camp Buehring

At Camp Buehring in Kuwait, Google Maps identifies what is labelled as the main headquarters building, as well as a gym and a self-help facility, all of which were among locations destroyed by recent Iranian strikes. In addition to Google Maps place markers there are dozens of reviews and user-uploaded photographs.

Bellingcat verified that this was a headquarters building by matching the flagpoles and layout in a photo published by the US military’s Defense Visual Information Distribution Service (DVIDS) showing soldiers posing in front of the  building to the Google Maps satellite image.

We also identified details about one of the camp’s gyms, including the building’s layout and roof structure, as well as Google reviews that indicate when it is busiest.

Among the images published by CBS News in September was that of a heavily damaged tent-like structure with smoke rising from it. Bellingcat matched the location of this image to the above satellite imagery, verifying that it shows the gym building pinned on Google Maps.

Exclusive images released showing damage to E-3 Sentry AWACS aircraft at Prince Sultan Air Base in Saudi Arabia, plus damage to US military camps Arifjan and Buehring in Kuwait from Iranian strikes. Images sent to CBS by active US military personnel. (IRIB News) https://t.co/1urA44f4xz

— Middle East Observer (@ME_Observer_) September 15, 2026

A building labeled on Google as “DPW Self-Help Center” was also destroyed at Camp Buehring. Its Google Maps listing includes opening hours, and a photo posted by a Master Sergeant in 2017 labeled “My office in Kuwait” shows the interior of an office. Some of the notices on the walls inside the office are legible, including what appears to be a floor plan.

A Google Maps placemark labelled “Transient Tent” identifies a large accommodation area, while another review includes a ground-level photograph of one of the tents. The dining facility can also be seen from the inside, including information regarding meal times.

William Goodhind of Contested Ground, a visual forensics consultancy that uses OSINT and satellite imagery to analyse military sites, said the information available on Google Maps could reveal “the camp’s layout, the division between secure and non-secure areas, confirms likely accommodation areas, and shows day/time periods of low and high activity.”

Camp Arifjan

A satellite image of Kuwait’s Camp Arifjan, captured by Planet on March 4, 2026 and published by the The Washington Post, shows damage to numerous structures at the base. Bellingcat compared the image with publicly available mapping data to identify two damaged facilities.

View this post on Instagram

A post shared by Media Trending (@tmctrending)

A Google Maps listing for a lodging facility labelled “TPE FOR ARIFJAN” includes a soldier’s review discussing room reservations, accommodation shortages and cleaning schedules, indicating that the building was used for military housing. Although Google’s satellite imagery of the base is blurred, the facility is visible in unblurred Bing Maps imagery using coordinates obtained from its Google Maps listing. The satellite image published by The Washington Post shows heavy damage to the facility.

A “24hr Fuel Point” tagged on Google Maps is also blurred, but when the coordinates are copied and pasted into Bing Maps a clear satellite image of the fuel station appears. This facility is also seen destroyed on the satellite imagery published by The Washington Post.

Bellingcat contacted Microsoft to ask why the facility was not blurred out in the Bing Maps service. A spokesperson said: “When an entity requests removal from visibility on Bing Maps, we work through our process and act accordingly.”

Muwaffaq Salti Air Base

Three US service members were killed in Iranian ballistic missile strikes on Muwaffaq Salti Air Base in Jordan on July 17, 2026. The strikes appear to have caused extensive damage to a barracks in the north of the base, with satellite imagery released by Iran showing at least 20 structures destroyed.

Less than 40 metres from the nearest destroyed structure, and within the same living quarters area, Google Maps reveals the location of an “Airman’s Attic”. These are volunteer-run thrift shops for US Air Force personnel. 

A five-star review posted last year by a soldier includes a ground-level image of the facility, showing uniform drop-off points and fortifications along the perimeter. The listing provides information about the area’s use, while photographs of the shop’s exterior make it possible to match the satellite imagery to the location on the ground.

A Sky News investigation also found that 80 percent of the runs shared publicly on the sporting app Strava at Muwaffaq Salti Air Base during the April ceasefire started or finished in this northern barracks.

Less than 100 meters from the destroyed area, “LSA DFAC” is pinned on Google maps. “DFAC” is the standard US military acronym for “dining facility”, according to Stars and Stripes. Several Google reviews also discuss the steak being served in this location.

Al Udeid Air Base

Similar mapping information is available for Al Udeid Air Base in Qatar, the largest US military installation in the Middle East. 

The base appears unblurred on Google Maps and entries on the platform identify the functions of numerous buildings. These include lodging facilities, which videos and reviews indicate are used by US Air Force crews and show the interior layout of the facility.

Meanwhile, Russia’s Yandex Maps details the site of two cinemas, a bar and a school on the base. This appears to match information provided on Google Maps.

While Al Udeid Air Base was damaged during Iranian attacks earlier this year, the areas that were struck do not appear to be among those listed on Google. 

Business Insider reported that a geodesic dome that housed secure communications equipment was hit in the strikes. ABC News detailed how another building had been damaged near the centre of the base. Google Maps shows a large warehouse-like structure at the location where ABC News reported this strike.

A New Reality in the Middle East

Former US Air Force targeting specialist Wes J. Bryant said the problem facing US bases in the Middle East reflected a broader assumption within the military that bases in allied countries were safe from serious attack. He said the belief that these were rear-area bases where “nothing’s going to happen out here” was a fundamental miscalculation, and that the Google Maps issue was an example of the military failing to account for that vulnerability.

Matthew Savill, Director of Military Sciences at the Royal United Services Institute, said Western militaries do not have consistent policies governing what information can be publicly posted about sensitive sites. He said the issue needs to be considered before a conflict begins, rather than when attacks are already underway. “The start point should be, can we enforce operational security discipline?” Savill pointed to restrictions already in place at some UK military facilities, including Faslane, a naval base that houses the UK’s nuclear submarines, where he said personnel are not permitted to use mobile phones on site.

Savill told Bellingcat that the different pieces of data available on Google Maps, even if outdated, provided a “pattern of life” about US bases in the Middle East. But he added that the use of Google to help with the military targeting of Western bases is not new, saying he encountered the issue while deployed to Iraq more than 20 years ago.

“When I was in Iraq, we knew for a fact that insurgents and militants had been using commercial imagery, including Google Earth, to try and map our bases,” he said. “We have known for more than 20 years that there is a vulnerability that if you don’t stop the collection and layering of data early on, that your bases can be heavily mapped.” 

The use of open-source information to support military targeting has been documented in Ukraine. In 2022, Foreign Policy detailed how Ukrainian private intelligence company Molfar used photographs of Russian soldiers published by Russian media alongside Google Earth satellite imagery to identify their location. Molfar passed its findings to Ukrainian intelligence, and the site was subsequently struck by the Ukrainian military.

The security risks of publicly mapping military installations were recognised by the US military in 2008, when the Pentagon banned Google’s Street View from documenting the interiors of its bases. Since the Iran war started, US military commanders have also warned service members about posting photographs and videos from bases after Iranian attacks, cautioning that such footage could help Iran assess the effects of its strikes.

Iranian attacks have forced US personnel to evacuate many additional locations that were deemed too vulnerable to further strikes. 

In total, 23 US service members have been killed and 865 wounded in the US-Iran war, according to the Pentagon.

---

Bellingcat’s Jake Godin, Charlotte Maher and Merel Zoet contributed to this report.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

The post How Online Maps Lay Bare the US Military Bases Targeted by Iran appeared first on bellingcat.

Sign up here to receive Bellingcat’s biggest investigations by email as soon as they are published. Become a member and support our work here.

An online ad for Ben McAdams, the Democratic candidate for Congress in Utah, emphasised that he could be trusted because he “fought back against MAGA”.

In Texas, another ad promoted Republican candidate Chris Gober, calling him a “MAGA warrior”.

What’s interesting is that both ads were ultimately paid for with money from the same organisation – Leading the Future (LTF), a Super PAC which opposes regulations that “constrain” innovation in AI. The network has received US$125 million in funding in total from OpenAI president Greg Brockman, his wife Anna Brockman, tech-focused venture capital firm Andreessen Horowitz (a16z) and a16z’s founders, Federal Election Commission (FEC) filings show. 

Directly opposing LTF is Public First Action (PFA), which calls for AI safety regulations and guardrails. PFA has received $40 million in funding from AI company Anthropic. 

Like the ads run by organisations funded by LTF, the Super PACs funded by PFA also ran ads that appeared supportive or critical of Trump depending on the voters they were targeting. 

None of these ads mentions AI.

As the US 2026 midterm elections approach on Nov. 3, Super PAC spending on political advertising has reportedly soared to record highs, surpassing US$11 billion last week and exceeding the amount spent on any other election cycle to date. 

Super PACs are a particular type of political action committee (PAC) that may receive unlimited contributions from individuals, corporations, labour unions and other PACs for the purpose of financing independent expenditures and other independent political activity.

In this year’s elections, LTF’s and PFA’s Super PACs, funded by the AI industry heavyweights, have played an outsized role in supporting or opposing candidates through advertising. But as polls show distrust of AI crosses party lines, the advertisements that Silicon Valley’s leaders are paying millions of dollars to try to sway the results in their chosen candidates’ favour often do not mention AI at all. 

While LTF is a registered Super PAC itself, FEC filings show it mainly disburses money to other Super PACs in its network which run political ads. 

Of about $52 million that LTF has disbursed to date, $20 million went to Think Big, which targets the Democratic voter base, and another $20 million went to American Mission, which focuses on Republicans. 

PFA, meanwhile, is registered as a “social welfare”, or 501(c)(4), organisation. This type of non-profit is not required to disclose its donors or disbursements. However, PFA contributes funds to three Super PACs: the bipartisan Public First PAC, Jobs and Democracy for Democratic candidates and Defending Our Values for Republicans. FEC filings for these Super PACs show Public First PAC received $1 million, Jobs and Democracy received $15.4 million and Defending Our Values received $7.9 million from PFA. Public First PAC’s FEC filings also show that $4 million of its $4.4 million in disbursements disclosed so far went to Jobs and Democracy, while another $300,000 went to Defending Our Values. 

Super PACs are allowed to accept unlimited contributions from other political committees, and other similar networks of Super PACs have been observed in the current election cycle, such as cryptocurrency-linked Fairshake and its affiliated Super PACs.

Bellingcat analysed data on more than 300 online video ad campaigns paid for by Think Big, American Mission, Jobs and Democracy and Defending Our Values from Google’s Ad Transparency Center. These ad campaigns, many of which used the same videos in slightly different formats or across different platforms, supported or opposed 40 candidates. 

Only ads supporting or opposing two candidates mentioned AI, and none mentioned data centres, a top issue this election cycle. A New York Times analysis of 95 video ads paid for by the same four Super PACs, using data gathered by media tracking firm AdImpact, had similar findings. FEC rules state that Super PACs can spend money to support or oppose a candidate, but cannot coordinate with the candidate or their campaign on this. There is no evidence that any of the candidates or campaigns for which the Super PACs ran ads have coordinated with them.

Michael Beckel, Director of Money in Politics Reform at cross-partisan political reform group Issue One, told Bellingcat that voters are at a disadvantage when special interests fund Super PACs running ads that don’t mention the priority issues of those underwriting them. 

“Special interests seem keen on moving voters with messaging around hot-button issues, all while advancing a specific policy agenda that viewers of ads are kept in the dark about,” he said. The result of this, Beckel added, was that “the industry gains a stronger hand in Washington, while voters get little chance to judge the agenda their votes could help advance”. 

A representative for PFA stated: “We endorse officials who support regulating AI. The aligned PACs run ads on the issues that matter most immediately to voters in each race, and for most electorates right now that means the economy, affordability, public safety, and other issues that they are facing on a daily basis.” 

Jobs and Democracy, Defending Our Values, LTF, Think Big and American Mission did not respond to questions about their political advertising as of publication. 

A recent survey by think tank Data for Action and non-profit Guardrails Action found that about three-quarters of likely voters would be less inclined to vote for a candidate if they found out they had accepted a donation from an AI Super PAC. 

The ads distributed by the AI-backed Super PACs supporting or opposing 29 candidates mentioned economic issues such as taxes, the cost of living, consumer rights and local jobs or small businesses. Another 16 mentioned immigration or law enforcement and 17 mentioned US President Donald Trump or his “Make America Great Again” (MAGA) movement. 

Like the ads mentioning Trump, those on immigration were sharply divided in messaging depending on whether they were targeting Democratic or Republican voters, even when they were paid for by the AI Super PACs in the same network. 

LTF’s Think Big sponsored an ad for Democratic candidate Jeremy Moss in Michigan that talks about how he stood up to Immigration and Customs Enforcement (ICE), while American Mission’s ad for Republican Clay Fuller in Georgia mentions how he is focused on securing the southern border. 

We found similar messaging in ads mentioning immigration that were paid for by Super PACs in PFA’s network. Defending Our Values ran an ad in support of Republican John Cowan in Georgia emphasising that he will combat illegal immigration, whereas Jobs and Democracy’s ad for Democrat Valerie Foushee in North Carolina said she was “leading the fight to hold ICE accountable”.

For the ads that did mention AI, almost all were in support of Alex Bores’ primary in New York. PFA’s Jobs and Democracy PAC ran 152 ads supporting Bores’ candidacy, at least some of which mentioned that he was in favour of safeguards on AI and holding Big Tech accountable. 

LTF’s Think Big, on the other hand, ran 22 ads opposing Bores’ candidacy. While they did not mention his stance on AI, many of Think Big’s ads focused on him receiving funding from Anthropic, “dark money Super PACs” and his former employer Palantir, the software giant whose technology, including a new AI system, is used in ICE’s immigration enforcement operations. 

Jobs and Democracy’s advertiser page also showed two ads for Josh Gottheimer in New Jersey that focused on the threats of AI scams and AI-generated media, urging voters to call Gottheimer to tell him to “stand strong for AI safeguards”. 

Major donors to LTF that Bellingcat reached out to – Greg Brockman, a16z, and a16z founders Marc Andreessen and Ben Horowitz – did not respond to requests for comment on their funding to the Super PACs as of publication. We could not find any publicly available contact information for Anna Brockman, but we also asked about her contributions to LTF in questions to her husband.

OpenAI did not respond to questions about the Brockmans’ contributions to LTF as of publication. However, the company published a statement on the topic in June, which said “OpenAI does not direct the activities of LTF, or have visibility into their operations” and that “any engagement with that organisation has been in a personal capacity, not on behalf of the company”. 

PFA’s main public donor, Anthropic, did not respond to Bellingcat’s queries about its funding for PFA and PFA’s political advertising as of publication. It said in a statement on its website in July that its donations to PFA were “to help promote policies that will maintain meaningful safeguards, sustain America’s AI leadership, and demand transparency from the companies building the most powerful AI models”.

Unknown Vendors

Federal campaign finance laws require federal political committees to file periodic campaign finance reports disclosing their receipts and disbursements. 

Our analysis of FEC filings for LTF and the Super PACs in its network revealed that they were channelling more than $36.4 million in total towards four companies that were newly set up, with no apparent online presence outside of these filings. 

A complaint to the FEC by the non-profit Campaign Legal Center (CLC) in May cited American Mission and Think Big’s payments to Summit Ridge and Lantern Productions, alleging that the Super PACs had “unlawfully evaded federal reporting requirements by funnelling their payments for goods and services through shell companies set up to conceal how the super PACs are actually spending their money”. The FEC has not yet ruled on the complaint. LTF, American and Think Big did not respond to Bellingcat’s queries about the complaint as of publication.

FEC filings show that LTF paid a company called Prusik Partners LLC more than $966,000 for operational expenditures for a range of services including communications and strategy consulting, as well as legal fees. 

The network’s Democrat-focused Super PAC, Think Big, paid a company called Lantern Production Consultants LLC more than $20 million, based on filings for disbursements from Aug. 20, 2025 to Oct. 14, 2026. 

The payments included $3.17 million for operational expenditures for a range of services such as media consulting and research, and another $17 million for independent expenditures. The FEC defines an independent expenditure as one that pays for “a communication that expressly advocates for the election or defeat of a clearly identified candidate”. The highest independent expenditures paid to Lantern ($8 million) were to oppose Bores’ candidacy, the filings show.

Think Big also declared in its filings that it had paid a company called Blue Horizon Compliance Consultants LLC almost $55,700 for “compliance consulting”. 

Republican-focused American Mission, on the other hand, paid a company called Summit Ridge Media LLC more than $13 million, based on filings for disbursements from Aug. 20, 2025 to Oct. 14, 2026. 

This included $2.2 million for operating expenditures such as polling and website services, and $10.9 million in independent expenditures, with the highest amount (about $960,400) going towards communications in support of James Morris Kingston, the Republican candidate for the House of Representatives in Georgia.

Bellingcat found that all four of these LLCs listed mailing offices and office supply goods stores in Nevada as their mailing addresses. We could not find records of them doing business with any entity outside of the LTF network – in fact, they appeared to have no online presence aside from their names appearing in the filings and business registrations. 

Despite their addresses being listed in Nevada, none of the companies could be found in the state’s public business registry. Instead, Bellingcat found registrations for Prusik, Lantern Production and Summit Ridge across the country – in Delaware. 

While Delaware is the second-smallest state in the US, more than half of all Fortune 500 companies are incorporated there according to the Delaware Secretary of State. The state’s business-friendly laws mean companies can reportedly incorporate in minutes and are only required to name a representative – who can be a paid agent unrelated to the business – in public registration documents, not the beneficial owners.

Articles of incorporation from the Delaware Secretary of State showed that Prusik was registered on July 22, 2025, while Lantern Production and Summit Ridge were both registered on Oct. 30, 2025. We also found a Delaware registration for a company called “Blue Horizon Compliance Group LLC”, registered on Oct. 30, 2025. While the name differs slightly from the Blue Horizon Compliance Consultants LLC that Think Big declared payments for, the registration was signed by the same agent listed in the documents for Lantern Production and Summit Ridge. 

The filings show that all of these companies – including Blue Horizon Compliance Group, if this was indeed the same entity referred to in Think Big’s filings – began receiving payments from the Super PACs within two to three months of their business registrations.

Saurav Ghosh, CLC’s Director of Federal Campaign Finance Reform, told Bellingcat that the group filed the complaint because “when groups funded by big corporate special interests evade transparency laws, voters lose”. 

“Federal reporting requirements help ensure transparency in our elections and protect voters’ legal right to know where the money is going,” Ghosh said. “Secret spending schemes like this make it virtually impossible to ensure that our elected officials are staying accountable to voters instead of wealthy special interests.”

We were unable to reach out to the LLCs as none of them had phone numbers or email addresses listed online. LTF, Think Big, and American Mission did not respond to questions about the LLCs, including whether “Blue Horizon Compliance Consultants LLC” listed in Think Big’s filings was the same company as Delaware-registered “Blue Horizon Compliance Group LLC”. However, a WIRED story on these same LLCs quoted a spokesperson from LTF as saying that the complaint was “a desperate ploy for attention from Public First, Anthropic, and the groups aligned with their outside organisations”. WIRED also quoted a Public First spokesperson denying that the group had anything to do with the complaint.  

Beckel suggested that stricter transparency measures relating to Super PAC spending would help inform and empower voters. For instance, Congress could pass legislation to require ads to include the names of the top donors, he said, adding that similar rules had been passed with cross-partisan support in places like Alaska and Arizona. 

“Congress would be doing voters a huge service by passing more robust transparency requirements for political ads. Voters deserve to know who is behind the ads they’re seeing,” Beckel said. 

About the Data

Google Ads Analysis

We reviewed ads available through Google’s Ads Transparency Center. These are ads served on Google platforms like Search, Display, Gmail and YouTube. We filtered specifically for ads shown between Jan. 1 and Oct. 23, 2026 in the US. 

We focused only on video ads classified as political advertisements, not text- or image-based ads. We looked at ads purchased by the following advertisers: Think Big, THINK BIG, American Mission, Jobs and Democracy PAC, JOBS AND DEMOCRACY PAC, Defending Our Values PAC and DEFENDING OUR VALUES PAC. 

In total, there were 336 advertisements in the dataset: 86 from Think Big, 57 from American Mission, 22 from Defending Our Values and 171 from Jobs and Democracy. Each ad listed on the platform was counted individually, although many of these were duplicates of the same ad that was run over a different period or platform. Some of the ads have also been removed for ad policy violations, but we were able to see which candidates they were for because they appeared when searching for ads specific to those candidates within the advertiser’s page. 

For the coding of themes, we looked at whether each of the themes mentioned (AI, data centres, economy, Trump, and immigration or law enforcement) appeared in any of the ads for each candidate. This does not account for how many times each theme may have appeared in ads for a candidate.

Our notes on the Google ad data and count of themes for each candidate can be found here. 

For the accompanying map showing spending by each Super PAC by state, we used data from the Google Ad Transparency Center showing the total spend per advertiser and the spending range per ad to estimate the spend per ad (as the data does not show the exact spend per ad). For each advertiser, we separately added up the minimum and maximum spend amounts for all ads. We then calculated where in that range the total spend fell (e.g. 45 percent between the minimum and maximum spend). The per ad spend was estimated by applying this same proportion to the range of each ad and rounding down to the nearest dollar.

FEC Campaign Finance Data

Data from FEC filings for LTF, Think Big and American Mission are based on disclosures from Aug. 20, 2025 to Oct. 14, 2026. Data from FEC filings for Public First, Defending Our Values and Jobs and Democracy are based on disclosures for Jan. 1, 2026 to Sept. 30, 2026, which were the latest available as of publication.

The amounts LTF and PFA contributed to their associated Super PACs are based on the recipient Super PACs’ receipts for contributions from “Leading the Future”, “Public First”, “Public First Action” and “Public First Action, Inc”. 

Links to the source pages for these filings, as well as the data we exported for our analysis, are available here.

---

This investigation was supported by a grant from the Tarbell Center for AI Journalism. 

Data visualisations by Galen Reich. Melissa Zhu contributed research to this piece.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

The post Inside the Secretive, Contradictory World of Campaign Ads Funded by AI Super PACs appeared first on bellingcat.

Cardano payroll could support ADA salaries and automated payments, but employers must address price volatility, tax obligations, wallet security and compliance.

Purpose and Scope This report summarizes the quantity of new ransomware samples collected, the number of compromised systems, and statistics on targeted businesses during the month of September 2026, as well as major Korean & global ransomware issues. The analysis is based on data collected through ATIP (AhnLab Threat Intelligence Platform) and AhnLab Smart Defense, […]

Sign up here to receive Bellingcat’s biggest investigations by email as soon as they are published.

Satellite imagery obtained by Bellingcat lays bare the extent of tree-felling at a Washington DC golf course that President Trump is reportedly seeking to transform into a championship-level course, despite moves to protect the site by conservationists. 

The extent and circumstances surrounding the rapid changes prompted a judge to call an emergency hearing earlier this week, banning any further changes until later this month.

Reports on Wednesday detailed that 430 trees were cut down at the East Potomac Golf Links  which is owned by the Federal government and managed by the National Park Service (NPS). This is despite a judge reportedly stating earlier this year that no more than 10 trees at the course could be cut down without first notifying the court. 

NPR reported that officials notified the court just before 5pm on Friday Oct. 9 of plans to remove up to 529 trees in phases starting  the next day on Saturday Oct. 10. That prompted US District Court Judge Ana Reyes to call an emergency hearing on Oct. 12. By that time, 430 trees had reportedly been cut down.

Reyes is reported to have said she was “furious” with the Justice Department for the lack of time afforded the court and plaintiffs before the tree removal was carried out.

She was also reported to have said that the government’s actions had cost it “all of its credibility with me in this case.”

Images taken at the course earlier this week show trunks and branches strewn out across fairways.

Just total devastation wrought on East Potomac Park this past weekend. 450+ trees. For an admin that professes to support “beautification” of DC, that’s sure not what we or anybody else who has seen what they did on Saturday would describe it as. East Potomac is (was?) a thriving, beautiful gem in the heart of Washington DC. A beautiful, public, accessible place that hundreds of thousands use annually. The assault on this place should infuriate every American. The impacts of what took place Saturday will take years to fix. We cannot sit idly by while this admin treats our public lands like they are for the taking.

— Save East Po (@SaveEastPo) October 13, 2026

But satellite imagery affords a broader look at exactly what sections of the course have been impacted.

The Image below from Planet Labs taken on October 8 shows the golf course before the tree-felling was carried out.

Planet Labs imagery captured on Oct. 13 shows large barren sections towards the south and west of the course, where trees were removed.

A before and after slider allows for easy comparison of the Oct. 8 and Oct.13 images.

Reuters reported that an organisation called The ​DC Preservation League said in a February ​2026 lawsuit that President Donald Trump was flouting ⁠environmental laws to “irreparably destroy a priceless piece of American history” so he could “convert a public recreation space into an exclusive, high-end golf course.”

Kevin Griess, an NPS official, reportedly stated at Monday’s hearing that tree removal was part of a 2019 plan that predates Trump’s aims for the course and sought to restore links-style vegetation.

Bellingcat contacted NPS as well as the Department of Justice but did not receive a response before publication.

The changes to the golf course are not the only ones President Trump has sought in Washington DC and the surrounding area since the beginning of his second term. In October last year  demolition began on the East Wing of the White House with the aim of building a new ballroom claiming it was “the safest building ever built.”  

Trump has also proposed a 250-foot-tall “Triumphal Arch” to be built just outside the Arlington National Cemetery in Virginia.

---

Correction: This article was updated on October 15 to reflect that a judge told the US government not to cut down more than 10 trees before providing notice. The article previously said that no more than 10 trees could be felled without the court’s approval. The headline has also been changed to reflect this.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

The post Satellite Images Show Extent of Trump Admin’s Tree-Felling at DC Golf Course appeared first on bellingcat.

Note The September 2026 Dark Web Breach Incident Trend Report focuses on data breach cases and the sale of initial access credentials posted on the deep web and dark web forums. The report explicitly states that the accuracy of some of its content cannot be fully verified due to the nature of the sources. Major […]

Sign up here to receive Bellingcat’s biggest investigations by email as soon as they are published.

US non-profits whose founding leaders or organisations have been associated with India’s controversial Rashtriya Swayamsevak Sangh (RSS) – or initiatives the Hindu nationalist group has endorsed – received millions of dollars over recent years through grants that allow donors to remain anonymous, a Bellingcat analysis has found. 

The right-wing and Hindu nationalist volunteer organisation is widely considered the ideological parent of India’s ruling Bharatiya Janata Party (BJP). Prime Minister Narendra Modi, a former RSS worker, is one of its most famous supporters. 

But the RSS’ vision of India as a Hindu nation is controversial both at home and abroad: it was previously banned in India three times, and a bipartisan US commission on religious freedom recently called for the US government to sanction the group “for their responsibility and tolerance of severe violations of religious freedom”. Almost a hundred US politicians, both Democratic and Republican, recently pledged not to take funding from RSS-linked entities. 

While there have been efforts to map out RSS-related entities, it can be challenging to establish concrete links between the organisations because the RSS remains an unregistered entity in India and has no formal membership, maintaining that it is a “body of individuals” with shared ideological views.

“The RSS functions without independent oversight of its resources, finances, influence, and activities,” said Dr Angana P Chatterji, an anthropologist and scholar of South Asia studies at the University of California, Berkeley. “This is not proportional to the vast power, reach, and influence it possesses. Its leadership and cadre are protected from accountability and scrutiny,” she added.

The RSS had not responded to multiple requests for comment, as of publication.

Bellingcat identified two US-registered non-profits that appeared to have past and present ties to the RSS, or organisations associated with them, based on the non-profits’ or RSS websites and publications, as well as statements by the non-profits’ founders and spokespeople. The non-profits were the Ekal Vidyalaya Foundation of USA Inc (Ekal USA) and Sewa International Inc (referred to as Sewa USA). 

We looked at all Form 990s – tax returns that US non-profit organisations are required to file annually – listing Ekal USA and Sewa USA as grant recipients, as well as the Form 990s of the charities themselves, from 2020 to 2024. As of September, the latest available Form 990s for Sewa USA were for the fiscal year ending December 2024, while Ekal USA also filed a form for the fiscal year ending December 2025, which was excluded for consistency, although the same pattern was observed during this period.

This analysis showed that the charities received at least US$24.4 million from 34 organisations that manage donor-advised funds (DAFs), or 20.7 percent of the total $117.8 million they reported receiving in contributions and grants during this period. 

The actual amount from DAFs may be higher, as we excluded filings that covered partial years outside of this period – for example, June 2019 to June 2020. The filings from the two charities we identified were based on the calendar year.

The Form 990s also revealed that the vast majority of the money spent by these two charities on grants to other organisations or individuals was in India or the South Asia region rather than in the US: Ekal USA donated $33.7 million in foreign grants – all of which went towards the Ekal Vidyalaya project in India according to its filings –  and none in domestic grants in the five years from 2020 to 2024, while Sewa USA reported $29.7 million in foreign grants and $622,613 in domestic grants during the same period. 

DAFs are common vehicles for people in the US who want to make donations to charitable causes while receiving tax relief or benefits. Donors do not control the money once they donate it but can advise on which charities the money eventually ends up at.

These funds are legally maintained and operated by non-profit sponsoring organisations. As public charities, DAF sponsor organisations detail the amounts and recipients of grants that they make on behalf of their donors in their Form 990s. However, they do not disclose who their donors are, and donors can choose to remain anonymous. (Note: Bellingcat US receives grants from donor-advised funds, and some grants do not disclose the name of the grant recommender. However, many of our donors are listed on our funding page.)

There are many more organisations reportedly linked to the RSS that are not included in this analysis, but we focused on these two because of the large amounts of grants they received through DAFs, with the original sources of the funds untraceable from public information, as well as evidence pointing to both historical and current connections between them and the RSS or organisations associated with the RSS. 

It is worth noting that some of the evidence we found pointing towards a connection between the two charities and the RSS or organisations associated with the RSS was from before or after the period we analysed (2020 to 2024). There is no evidence that DAF grants funded the RSS, only that they went to organisations that appear to have connections with the RSS. Experts told us that DAF grants undergo less regulatory scrutiny than other charitable donations and that DAF sponsor organisations have discretion over whether to restrict or permit donations to certain recipients.

Ekal USA

Houston, Texas-based Ekal USA is a non-profit that describes its mission in its Form 990s as “to provide free elementary education and free primary healthcare to children in remote and rural India”. The USA branch of Ekal Vidyalaya, according to its website, was founded in 2001 as part of efforts to “reach out to the global diaspora” in order to achieve a goal to “expand the reach of Ekal to 100,000 villages”. 

RSS chief Mohan Bhagwat has appeared at multiple Ekal Vidyalaya events in India promoting the initiative over the years, as far back as 2014 and most recently in May.

Ekal USA was started in the late 1990s as a programme of the Vishwa Hindu Parishad of America (VHPA), or World Hindu Council of America, VHPA spokesperson Shyam Tiwari told Bellingcat in an email response. He added that it was set up as an independent organisation in early 2000. According to VHPA’s website, Ekal USA was established in 2002.

VHPA is based in the US, while the similarly named Vishwa Hindu Parishad (VHP) is in India. VHP lists VHPA in the “Hindus Abroad” section of its website. A 2017 article from VHPA’s magazine states that late founder Mahesh Mehta was trained by the RSS since he was 10 years old, and that the VHPA was born after Mehta was advised by the former supreme leader of the RSS to “build VHP in USA”. The national spokesperson of VHP in India, Vinod Bansal, said that it is an independent organisation that “sometimes shares ideology” with VHPA.

RSS’ website states that VHP was launched to organise Hindus and “reconvert all those who had been knowingly or unknowingly proselytised to alien faiths and are now desirous of coming back to the Hindu fold”. Bansal referred to VHP as an “independent part of the RSS” and an “ideological brother”. 

Ekal USA Chairman-Advisor Subhash Gupta wrote in an Ekal USA publication this year that in the ‘80s and ‘90s, he was “president of the VHP’s Houston chapter” and “often received many high-profile guests from RSS and VHP”.

Gupta did not respond to requests for comment as of publication.

From 2020 to 2024, Ekal USA reported receiving more than $48.4 million in contributions and grants. Of this amount, at least $8.3 million was from DAF grants, based on Form 990s that listed Ekal USA as a grantee. 

According to Ekal USA’s Form 990s, it transferred $33.7 million in foreign grants during this period and none in domestic grants for organisations or individuals. The forms also show that all the foreign grant money went towards building Ekal Vidyalaya schools in India. The rest of its expenses involved operational costs such as staff salaries.

The Ekal Vidyalaya movement has been criticised over reports that allege the schools are used to indoctrinate millions of India’s poorest and most vulnerable children and women with Hindu nationalist ideology, including that Muslims and Christians are “enemies of Hinduism”. Ekal Vidyalaya in India did not respond to multiple requests for comment.

Ekal USA did not respond to Bellingcat’s questions about these reports or any relationship it may have with the RSS. However, on its FAQ page, the group states that it does not teach religion in its schools and “does not discriminate based on caste, religious affiliation or linguistic affiliations”.

Sewa USA

Sewa USA, also based in Houston, describes itself as a “Hindu faith-based, humanitarian, nonprofit service organisation” and is listed under the heading of “Sewa Movement” on the website of India-based charity group Sewa International. 

Sewa USA Vice President of Public Affairs Rakhi Israni told Bellingcat over email that the organisation “does not operate as a branch or affiliate of the RSS” or participate in political activity. 

But multiple pages on the organisation’s website appear to indicate a connection between the non-profit and the RSS. In 2022, Sewa USA reposted an article on its website referring to Sewa International as “the US-based charitable non-profit organisation with links to the Rashtriya Swayamsevak Sangh (RSS)”. In a press release about the death of its founding member Ved Prakash Nanda in 2023, it noted that Nanda was “immersed in the ideals of the [RSS]”. And two different blog posts from 2021 and 2024 on Sewa USA’s website had volunteers citing RSS-led activities as the starting point for their involvement.

In addition, Sewa USA has also posted multiple times on social media and its website about an India-based organisation – Sewa Bharati – that appears to have the support of the RSS. 

Sewa USA referred to Sewa Bharati as a “sister organisation” in an X post in 2014, and its regional chapter in Purvanchal as a “partner organisation” in a Facebook post in 2022.

On its website, Sewa USA said in a post that volunteers from its “partner organisations in India” had participated in rescue operations related to the 2023 train accident in Odisha, and listed several initiatives by Sewa Bharati in India. It also launched a fundraiser for families affected by floods in Maharashtra in September 2025, which mentioned that over 100 Sewa Bharati volunteers were already on the ground clearing debris and assisting communities. 

“Foreign grants awarded to partner agencies in India, including service-oriented NGOs like Sewa Bharati, are strictly project-based, fully audited, and evaluated based on measurable humanitarian impact in education, health, and disaster relief,” Israni told Bellingcat.

RSS’ website links directly to the main website of Sewa Bharati through a tab on its main navigation bar labelled “Sewa”, and Sewa Bharati is mentioned in RSS’ 2016 annual report under the heading “Seva Vibhag”, a Sanskrit term for “service department”. 

A blog post on Sewa Bharati’s website from December 2024 about an event the group organised described Indian Defence Minister Rajnath Singh as highlighting the role of RSS leaders in establishing Sewa Bharati in his address and noting that “RSS not only builds the nation but also the individual”. RSS Joint General Secretary Alok Kumar also spoke at the Sewa Bharati event, according to the blog post. 

In response to Bellingcat’s queries, Israni said that Sewa USA had “no role in Sewa Bharati’s governance or operations”. Sewa Bharati did not respond to multiple requests for comment as of publication.

Sewa USA received almost $69.4 million in contributions and grants from 2020 to 2024, according to its Form 990s. Filings listing Sewa USA as a grantee show that at least $16 million was from DAFs. In its expenditure statements, Sewa USA reported giving $29.7 million in foreign grants to groups in South Asia during this period and about $622,613 in grants domestically in the US, while the rest of its expenditures included operational costs such as salaries and travel. It is not specified in the forms how much funding, if any, Sewa USA transferred to Sewa Bharati during this period, and Sewa USA did not respond to questions about any amounts transferred as of publication. 

‘Cause-Neutral’ Funding

Experts told Bellingcat that there was less regulatory scrutiny of grants distributed through DAFs than some other types of charitable donations.

“For donor-advised funds, there’s actually less oversight by the IRS because donor-advised funds are considered public charities rather than private foundations,” said Samuel Brunson, a law professor at Loyola University Chicago.

“If a private foundation were giving money to organisations in India, that would be a little bit trickier. But if it’s a public charity … there’s not really a ton of oversight on that as long as the money that the US tax-exempt organisation is giving meets its charitable purpose.”

Lloyd Hitoshi Mayer, a law professor at the University of Notre Dame who specialises in non-profits, said that it was “irrebuttably presumed” that funds granted to US organisations with the non-profit 501(c)(3) tax status were being used for good charitable purposes.

“The existing federal tax laws related to donor-advised funds put some restrictions on what grants donor-advised fund sponsor organisations, which actually control the funds, can make. But the big exception is that Congress said, ‘If you make a grant to a Section 501(c)(3) charity, you’re good.’ You don’t have to do any additional oversight.”

Some DAF sponsor organisations have previously faced criticism for granting money to charities that have promoted homophobic, anti-immigrant or anti-Muslim views. Several were also criticised for pausing funding to the Southern Poverty Law Centre earlier this year, although this case demonstrated how DAFs can prevent funds from going to some groups recommended by donors, if the DAFs deem them unsuitable. 

Brunson told Bellingcat that DAF sponsor organisations “absolutely have the right and ability” to halt processing donations to certain organisations. “Whether we want them to do that or not is a separate question,” he said. 

Bellingcat reached out to the top three DAF sponsor organisations that donated to the two non-profits we identified – Fidelity Investments Charitable Gift Fund (Fidelity Charitable), American Online Giving Foundation (AOGF) and Charles Schwab-affiliated Donor Advised Charitable Giving (DAFgiving360; known before 2024 as Schwab Charitable) – to ask about their internal policies on assessing charities receiving donations through their funds. In total, the three DAFs accounted for almost $20 million, or 81.7 percent, of the DAF grants to Ekal USA and Sewa International for full reporting years between 2020 and 2024. 

Fidelity Charitable, AOGF and DAFgiving360 all told Bellingcat that they had due diligence processes in place when evaluating non-profits. 

Fidelity Charitable’s website states that it is a “cause-neutral” charity, but it ensures grants are used solely for charitable purposes. AOGF said non-profits must comply with eligibility requirements regarding hate speech, discrimination and the use of funds. 

Meanwhile, DAFgiving360 said that a grant recipient may be subject to monitoring or placed under temporary suspension “due to circumstances that DAFgiving360 deems appropriate”, such as if there is a public interest consideration or if the recipient does not further DAFgiving360’s mission.

---

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

The post Groups Associated With India’s Far-Right Receive Millions Through US Donor-Advised Funds appeared first on bellingcat.

Purpose and Scope This report summarizes statistics on new ransomware samples, affected systems, and statistics on targeted businesses collected during the month of August 2026, as well as major Korean & Global ransomware issues. Statistics on targeted businesses were compiled based on the time when publicly available information from ransomware groups’ DLS (Dedicated Leak Sites, […]

Hackers targeted two Colorado water utilities, changing OT settings and disabling alarms, but causing no impact on water services or safety.

Foreign hackers targeted the operational technology (OT) systems of two small private water utilities in Colorado in late August, apparently trying to disrupt operations. Local authorities haven’t identified the affected utilities or the attackers.

Attackers reportedly changed equipment settings, disabled remote access and alarms, and modified pumping cycles. The incidents were brief and did not affect water services or public safety. The utilities serve fewer than 200 people, and few technical details are available.

The Colorado governor added the attack was carried out by ‘foreign actors’.

“The intrusions did not affect drinking water quality or treatment processes, according to Colorado Gov. Jared Polis’ office. But the incidents add Colorado to a widening series of breaches in U.S. water and wastewater infrastructure.” reported Fox News.

“These two incidents consisted of individuals changing equipment settings, disabling remote access and alarms, and altering pumping cycles,” Polis spokeswoman Ally Sullivan said in a statement. “These were brief incidents, and the risks were quickly addressed by the providers themselves, who subsequently alerted the state.”

“We cannot confirm what foreign actors may have been involved, but we are aware of ongoing efforts across the nation by an Iranian-backed group to access drinking water and wastewater systems, as per the Cybersecurity and Infrastructure Security Agency,” Sullivan wrote in a separate statement.

Despite references to Iran-linked attacks, there is no confirmation that the two Colorado utilities were part of the same campaign that targeted water facilities in at least a dozen US states in July.

Federal authorities have not published a complete list of affected utilities. However, confirmed targets include facilities in Minnesota, Michigan, Alabama, Georgia, New Jersey, South Dakota,and Wisconsin. The available evidence does not currently establish a direct link between those attacks and the Colorado incidents.

The recent attacks have renewed concerns about cybersecurity weaknesses in U.S. water infrastructure, especially at small and rural utilities that often have limited security staff and resources.

In August, CISA urged water utilities to find and secure internet-exposed PLCs after July attacks showed how easily exposed industrial systems can be compromised.

Over 100 internet-exposed systems in the US water and wastewater sector got hit by cyberattacks in July 2026, and CISA’s response wasn’t just an incident report, it was a how-to guide for making sure it doesn’t happen to you next. The agency’s exposure reduction guidance, published August 21, walks through exactly how organizations can find their own internet-facing weak points before an attacker does.

The pattern behind the July attacks was surprisingly simple. Most of the affected systems were programmable logic controllers (PLCs), small industrial computers that control pumps and valves. Many connected directly to cellular modems and had no firewall or gateway between them and the internet. CISA warns that this type of setup can expose PLCs to serious security risks.

“Directly connecting PLCs to the internet through cellular modems can create significant security risks. However, internet exposure reduction does not mean disabling necessary remote access; organizations should remove remote access when it is unnecessary and secure it when it is necessary.” states CISA.

Hackers remotely accessed exposed PLCs, changed device IP addresses and passwords, and in some cases disabled shutdown processes and alarms, creating what CISA called unsafe conditions without notifying the operators running the actual equipment. Iran is the suspected actor behind much of this activity, likely tied to the ongoing war involving the US and Israel, though officials have stopped short of a formal attribution.

Since fiscal year 2025, the EPA has identified more than 900 vulnerabilities across over 650 water systems and helped address about 700 of them at more than 500 utilities. The agency has also carried out more than 710 cybersecurity risk assessments and provided technical support to around 15,900 utilities.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, water utilities)

ASEC Blog publishes Ransom & Dark Web Issues Week 2, September 2026           The Gentlemen Ransomware Attack on a Canadian Airline LAPSUS$ Group Resumes Chapter II and Teases New Victim Disclosure AUDIT TEAM Data Extortion Attacks on Four Organizations in South Korea, Germany, and Argentina

ASEC Blog publishes Ransom & Dark Web Issues Week 1, September 2026           ZaWoo Data Extortion Attacks Against Multiple Organizations Worldwide Black X Ransomware Attack on a South Korean Automotive Parts Manufacturer Internal Data of a South Korean Asset Management and Investment Firm Offered for Sale

Sign up here to receive Bellingcat’s biggest investigations by email as soon as they are published.

On a June night in 1996, in a basement apartment in Boston’s Chinatown, a killer put a pistol to the back of a young man’s head and pulled the trigger. The victim’s body was wrapped in quilts, lowered into the trunk of a car and driven about 20 miles southwest of the city, where it was dumped in the woods. It lay undiscovered through two New England winters until a dog walked home carrying a human bone. 

For three decades, authorities did not release the victim’s name to the public. He is listed in the National Missing and Unidentified Persons System (NamUs) as #UP12385, one of 202 unidentified people recorded in the state of Massachusetts. The circumstances of his discovery are reduced to five words: “Skeletal remains found in woods.” The case remains unsolved.

Bellingcat spent more than a year investigating in an effort to put a name to the victim. Using open sources, including freedom-of-information requests and newspaper archives, as well as interviews with investigators who worked on the case, we pieced together the story of the man’s life and death in an era before the internet kept a digital record. In total, we submitted 27 public records requests to 18 local, state and federal law enforcement agencies. We also contacted more than two dozen investigators, prosecutors, crime victims, journalists, experts and community groups connected to the case, though most said they did not recall the 30-year-old murder. 

We learned that authorities identified the victim as Fu Chun Wang, a 26-year-old undocumented Chinese immigrant who did not speak English. We also learned of a sweeping investigation into Chinese organised crime in New England in the late 1990s. Authorities suspected Wang was a member of the Fukienese Flying Dragons, a gang the FBI described at the time as a “violent offshoot” of the larger Flying Dragons crime ring.

Based in New York’s Chinatown, the Fukienese Flying Dragons were active across much of the East Coast. The gang trafficked migrants, extorted and robbed businesses, kidnapped for ransom and murdered rivals. Authorities believed Wang belonged to the Boston faction of the group, which was suspected of carrying out home invasions targeting Asian and Asian-American restaurant owners and staff across New England in 1996. 

Heavily redacted FBI documents and correspondence between local and state authorities show that a federal operation investigating the home invasions uncovered information about Wang’s murder and other crimes. The operation, whose name is redacted, was led by the US Attorney for the District of New Hampshire.

Authorities suspected that the Boston-based members of the Fukienese Flying Dragons were also involved in prostitution, illegal gambling and kidnappings in multiple states. Investigators examined possible ties between the gang and a suspect in one of Boston’s deadliest mass killings: the 1991 Chinatown Massacre. 

According to these newly released files, investigators received information that Wang had been murdered by members of his own gang shortly after Boston Police arrested and charged him for using credit cards stolen in one of the home invasions. While some gang members were identified as suspects and investigated, none were ever charged and convicted for the murder.

A Dog with a Bone

On April 10, 1998, a resident in Sharon, an affluent suburb southwest of Boston, called the police. Their black Labrador retriever had returned from the woods carrying a large bone. Four days later, testing by the coroner’s office in Boston determined it was a human femur likely belonging to an adult male. Police searched the woods, where a detective uncovered more bones near a bundle of quilts. Inside, they found a decomposed skeleton. 

A coroner ruled that the victim was a man in his twenties or thirties who was possibly Asian or Native American. He had long black hair with blonde streaks. There were at least two overlapping bullet holes in the back of his skull. Local media reported at the time that the victim had been shot “execution style”. A single, corroded .380 calibre shell casing was found inside the quilt. The victim was wearing a green-and-white striped rugby shirt, denim jeans and white leather sneakers on the night he died. Loose change, a pocket knife and a tarnished set of keys were found nearby on the forest floor. 

A botanist from Harvard University determined the body had likely been in the woods for at least 18 months. Experts from The Smithsonian Institution told police that forensic facial reconstruction would be “of questionable value” due to the damage caused by the gunshot injuries. 

Before his murder, open source records of Wang’s life amounted to a few scattered data points: interactions with authorities, apartment rentals, a loan application and a hospitalisation following a car accident. 

Police reports after his death show investigators pieced together a patchy collection of biographical data. He was from a family of five in Dongshan, a village in the southeastern Chinese province of Fujian, and was likely born into poverty. During his autopsy, it was noted that his teeth showed signs he had been “undernourished” as a child. He moved to the US to work in the restaurant industry and eventually joined a gang. 

Wang migrated at a time when thousands of Fujianese were arriving in the US every month in search of a better life. Like many migrants at the time, he entered the country without documentation. By 1994, when Wang met with immigration authorities in Boston, he gave his address as an apartment on East Broadway in New York’s Chinatown. Two years later, he was issued an employment authorisation card. Boston Police would learn from the Immigration and Naturalisation Service (INS) that Wang had been granted political asylum.

Search results on Ancestry.com suggest that prior to living in Massachusetts, Wang had also lived in Virginia and Vermont. Records from the Sharon Police Department corroborate these findings. In Virginia, police learned that he worked in restaurants and had applied for a loan to buy a car, a 1994 green Mitsubishi Mirage. 

In Vermont, Wang worked at a Chinese restaurant called Men-at-Wok until he was injured in a car accident in May 1996. After he was reported missing a month later, his car sat unclaimed in an auto body shop in Vermont until a bank sought to reclaim it.

Unclaimed checking and savings accounts at Fleet National Bank are listed under Wang’s name and the Quincy address in the Massachusetts unclaimed property database. The amount of money in these accounts is not publicly available, but the presence of unclaimed funds in his name, along with his abandoned car, are some of the many indicators that he met with foul play.

‘We’ll Kill Your Family’

In the summer of 1996, Chinese restaurant owners and their staff in suburban Boston and New Hampshire were terrorised by a wave of violent home invasions and robberies. Police described the suspects as “an organised group of Asian individuals”.

The modus operandi was often the same. In the early morning hours, young men barged into rooming houses while Chinese restaurant workers slept. Sometimes they robbed the business owners’ homes. Armed with guns and knives, the intruders tied up their victims before stealing cash and valuables. One woman who was attacked at knifepoint told police an assailant threatened: “Shut up or I will kill you”. In another case, a victim was stabbed.

The assailants were described as young men or teenagers. In several cases, victims reported that they spoke Fuzhou, also known as Foochow, a language originating from eastern Fujian Province. 

Jim Keating, a retired Sharon Police detective, told Bellingcat that many Asian gang extortions and robberies in the Boston area at the time were not reported. “They were all afraid of these guys, because they said, ‘We’ll come back and we’ll kill your family.’ And they would.”

In the span of a few months in 1996, similar robberies occurred in the Massachusetts towns of Bedford and Westborough, as well as Malden, a city about 10 kilometres north of Boston. These were followed by home invasions in the bordering state of New Hampshire, in Wolfeboro, Merrimack, Lebanon and Manchester. It is unclear if the home invasions and robberies were connected, but Bellingcat’s review of historic newspaper clippings and newly released police documents suggest that at least one other gang may have been responsible for some of the crimes. 

In response to the crime spree, local, state and federal law enforcement agencies coordinated investigative efforts. Bellingcat obtained files detailing a federal operation led by the US Attorney for the District of New Hampshire. It included agents from the FBI, INS, Drug Enforcement Administration, Bureau of Alcohol, Tobacco, Firearms and Explosives, Customs Service, Border Patrol and Royal Canadian Mounted Police, along with officers from state, county, and local law enforcement agencies in New England.

Ben Leong, a retired Boston Police detective, said Asian gangs committing robberies, extortion and home invasions against restaurant owners and their staff were common in the 1990s. He said many of these crimes went unreported for cultural reasons, over fears of gang retaliation, and because victims did not trust law enforcement.

“Back then there were many factions of gangs,” he said. “The gang members were recruited throughout the country, nationally and internationally. Law enforcement was always playing catch up to identify the prevalent groups, and the individual members and leaders committing illegal activity.” 

Leong, who is president of the International Organisation of Asian Crime Investigators and Specialists (IOACIS), said authorities had a better understanding of gang culture in Boston by around 1996 when local, state and federal agencies began sharing information.

Murdered in Chinatown

On June 9, 1996, one day after a home invasion in Wolfeboro, New Hampshire, Boston police were called to a Macy’s department store when a man tried to use credit cards stolen in the robbery to buy jewellery and electronics. He was arrested and booked on charges of receiving stolen property. The man was Fu Chun Wang.

In Sharon Police records, Wang was described as “very depressed” and “possibly suicidal”. He told a Boston Police detective that he urgently needed to send $1,000 to his family in China. Other records said his father was ill and needed money. Files found on Judyrecords.com, a free database that purports to include more than 770 million US court case records, show that Wang was arraigned and a court appointed a defence attorney to him. He was bailed out after pleading not guilty. 

Less than two weeks later, on June 21, Wang was reported missing to the Quincy Police Department in Massachusetts. The police report said Wang was last seen in Boston’s Chinatown on June 13, two days after he left jail. Police records indicate that a female friend of Wang’s had asked an attorney to file the missing persons report. The attorney who reported him missing told Bellingcat that he did not remember Wang. 

The Sharon Police Department’s murder case file notes that within weeks of finding the human remains in the woods, they received information from Boston Police and the FBI that “Wang was murdered in Chinatown” in June 1996 and “his body [was] never found”. 

Not all documents were released to Bellingcat, and some names were redacted. Fragmentary notes and witness statements provide the only clues to Wang’s final days. In handwritten records, Sharon Police said a man who was described as the “head of [an] Asian gang in Boston” had Wang killed over the New Hampshire breaking-and-entering incident.

A note in the Sharon Police file described a witness to Wang’s murder as a “Flying Dra” and a “NY gangster”. Retired detective Jim Keating confirmed to Bellingcat that Wang, along with his associates and killer, were suspected members of the Fukienese Flying Dragons. He said he believed Wang was murdered because he posed a risk to the gang following his arrest.

Documents released by the Merrimack Police Department and Sharon Police Department said that an inmate in New York who, in 1997, was serving a 25-year sentence for attempted kidnapping, offered to share information about Wang’s murder with the FBI in return “for a reduction (sentence)”. The inmate implicated the gang in at least two 1996 New Hampshire home invasions and also gave authorities information about the murder.

The account is heavily redacted but includes a note that the US Attorney for New Hampshire was making arrangements to interview the man. Police in New Hampshire said they believed the inmate “was truthful in his statements and has knowledge about the murder of Mr Wang”. Keating confirmed to Bellingcat that he and investigators from other law enforcement agencies traveled to New York to interview the man. He said the inmate, a suspected member of the Fukienese Flying Dragons, gave a statement on Wang’s murder. 

Keating said that investigators had learned of a dispute on the night of the murder between Wang and the gang’s leader. He said Wang had planned to run an illegal gambling operation at an apartment, which the gang boss was using as a prostitution venue. This led to an argument at another location, and when Wang left for the apartment the boss followed him. 

But Keating said that based on the information gathered throughout the investigation, he believes the primary motive for Wang’s murder was his arrest over the use of credit cards stolen in the Wolfeboro home invasion. With that arrest, Wang presented a risk to the rest of the gang because investigators could tie them to the home invasions. “Wang broke the basic rules by taking something that was identifiable and using it, and that’s what the whole damn thing was about,” Keating said.

Keating told Bellingcat that the crime scene had been damaged by flooding after the murder. He said he used a power saw to cut off the bottom of a door in the unit and that lab testing revealed the presence of Wang’s blood. 

Investigators also worked to confirm Wang’s identity by testing the DNA of the remains found in the woods. In a 1999 case summary written by a Massachusetts State Police Trooper, it was noted that the FBI was attempting to locate Wang’s parents through police in China.

Three months later, the FBI’s Hong Kong office sent a communique to Boston confirming that the Chinese Ministry of Public Security and Interpol had located Wang’s parents. Wang’s mother, it said, was willing to provide a DNA sample for comparison. 

The FBI communique is the final document in the newly released files that details the efforts to confirm Wang’s identity with DNA. However, Keating told Bellingcat that a DNA sample was obtained from Wang’s mother in China. It was brought back to the US for testing and confirmed to be a match, he said. “I don’t know when the DNA was collected or who did it. But I know that they did that,” Keating said. “There is no question about who he was.” 

Bellingcat contacted both the Norfolk and the Suffolk County District Attorneys to confirm the DNA match, but did not receive a response to questions about DNA testing or the victim’s identity. Other former law enforcement officers named in the files released to Bellingcat have not responded to requests for comment. 

One document included in the murder file references discussions between homicide investigators and the FBI about charging Wang’s killer with home invasion offences. The note discusses the potential to have a witness testify against Wang’s suspected killer. It is unknown whether he was ever charged. 

The Shooter

The man authorities suspected of shooting Wang, or ordering his killing, was described in the documents as the head of the Fukienese Flying Dragons in Boston. Police said he was an undocumented immigrant from Fujian Province who ran a sex trafficking ring. 

A redacted note in the Sharon Police Department murder file references Wang’s suspected killer as “a player” in the Chinatown Massacre, an infamous 1991 case in which five men were shot dead in a basement gambling parlour in Boston. In another note in the case file, investigators wrote that he was “thought to be a federal informant”. 

The name of the gang boss was redacted in the police file released to Bellingcat.

Keating said Wang’s identity was confirmed by DNA and that blood evidence, corroborated by witness statements, placed his killing in the Boston Chinatown apartment. The retired Sharon detective said at that point, the Boston Police Department and the Suffolk County District Attorney’s Office should have, respectively, taken over the investigation and prosecution of the case. 

The Boston Police Department did not respond to questions from Bellingcat. It does not include the killing in its list of unsolved homicides. 

The Suffolk County District Attorney’s Office said it did not have records for Wang’s murder. “Unfortunately, after a thorough search with assistance from our homicide unit, no responsive records could be located,” it said.

In response to Bellingcat’s original public records request, the Norfolk County District Attorney’s office, which covers Sharon, said the files were exempt from public disclosure because they pertained to “an active and ongoing criminal investigation”.

A spokesman for the office said last week that the circumstances surrounding the remains of an adult male discovered in Sharon in April 1998 “remain under investigation” by a state police detective assigned to the Norfolk District Attorney’s Unsolved Case Unit. 

The FBI confirmed that the agency assisted state and local partners in an operation investigating home invasions in the late 1990s but did not answer questions about Wang’s murder or his suspected killer. “Given that we’re not the lead, we’ll refer you to Massachusetts State Police,” a spokeswoman said.

Massachusetts State Police referred questions to the Suffolk and Norfolk County District Attorney’s offices.

It remains a mystery why Wang’s killer was never charged and prosecuted for his murder. “They got away with so much. Blatantly got away with so much,” Keating said of the gang. “Killing people for these guys was like … these guys were all expendable.”

The Norfolk District Attorney’s Office encouraged anyone with any information about the case to contact the Massachusetts State Police Tip Line or the Sharon Police Department.

---

Melissa Zhu contributed research to this article.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

The post Investigating a Murder: Public Records Uncover New Clues in Chinatown Cold Case appeared first on bellingcat.

Sign up here to receive Bellingcat’s biggest investigations by email as soon as they are published.

Satellite images obtained and analysed by Bellingcat show over five miles of new road constructed in Big Bend National Park in southwestern Texas, part of a US Customs and Border Protection (CBP) “Smart Wall” installation, which includes roads, barriers, lighting and cameras. 

The project was paused earlier this week after pushback from local residents, politicians and environmental groups.

The roads have been built adjacent to the Rio Grande, through the river’s floodplain and riparian forest, and include construction adjacent to Cottonwood Campground, Santa Elena Canyon, and Mariscal Canyon in the National Park.

The map above traces the new road construction in yellow. An unannotated version of the satellite image showing the new road can be found here while a before image of the same area where no road is visible can be seen here.

The new road extends to Cottonwood Campground, one of four campgrounds in Big Bend National Park. 

The road can be seen crossing the riparian forest and smaller drainages before joining the campground access road. Imagery also appears to show bright yellow construction equipment staging in the campground area, where bulldozers were previously seen.

In the southernmost part of Big Bend National Park, additional new road construction is also visible near Mariscal Canyon and connecting to Talley Road. 

CBP planning documents indicate that this section of the border will receive a four-to-six foot tall vehicle barrier in addition to the “smart wall” lighting and camera systems. Talley Road currently provides access to riverside backcountry campsites and hiking and boating access to Mariscal Canyon on the Rio Grande.

The map above traces the new road construction in yellow. An unannotated version of the satellite image showing the new road can be found here. A before image of the same area where no road is visible can be seen here.

CBP Commissioner Rodney Scott described the construction activities as “survey and design work” in an August 13 statement. He also stated that CBP is “building one new access road, improving existing roads, installing detection technology, and placing vehicle barriers in limited, strategic locations.”

However, by August 17 Scott had announced a “pause” of construction activities in the face of  bipartisan criticism of the project’s impact to the environment, recreation access, and the local economy

The Big Bend Border Patrol Sector sees the fewest migrant apprehensions of any part of the US southern border, according to CBP’s own data.

---

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. Subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

The post Satellite Imagery Documents New Border Patrol Road Construction in Big Bend National Park appeared first on bellingcat.

IT threat evolution in Q2 2026. Mobile statistics
IT threat evolution in Q2 2026. Non-mobile statistics

The mobile section of the quarterly cyberthreat report includes statistics on malware, adware, and potentially unwanted software for Android, as well as descriptions of the most notable threats for Android and iOS discovered during the reporting period. These statistics are based on detection alerts from Kaspersky products, collected from users who consented to provide statistical data to Kaspersky Security Network.

The quarter in figures

According to Kaspersky Security Network, in Q2 2026:

• More than 1.99 million attacks on mobile devices utilizing malware, adware, or unwanted mobile software were blocked.

• The Trojan-Banker category was the most prevalent mobile malware threat with a 30.77% share of total detected applications.
• More than 304,000 malicious installation packages were discovered, including:
  • 93,574 packages were related to mobile banking Trojans;
  • 570 packages were related to mobile ransomware Trojans.

Quarterly highlights

Attacks on mobile devices involving malware, adware, or unwanted software continued their downward trend, falling to 1,996,823 in Q2 from 2,676,328 the previous quarter.

Attacks on users of Kaspersky mobile solutions, Q4 2024 — Q2 2026 (download)

We noted a downward trend in attacks driven by specific strains of pre-installed Trojans — a shift likely tied to the rollout of patched vendor firmware.

In Q2, our telemetry uncovered multiple malicious loaders hosted directly on Google Play. As highlighted in a prior report (link in Russian), one such instance involved a PDF reader app trojanized to drop the Anatsa banking malware. Upon execution, the app presented users with a fake request to install an update, which served as a front to stage the banking Trojan on the victim’s device.

Another notable case involves a loader we detected in the Cleanova app alongside several others. The malware sent requests to a command-and-control server containing telemetry gathered from various SDKs that track the installation source. A malicious payload was returned only for certain sources. This is a fairly interesting method for bypassing app store review processes while ensuring precise victim targeting. If an analytics SDK indicates that an arbitrary installation originated from a source outside the threat actors’ scope, the malicious logic remains dormant. This effectively hides the malware from app store scanners.

Mobile threat statistics

In Q2, the number of Android malware samples totaled 304,128. It remained steady compared to the previous reporting period.

Detected malicious and potentially unwanted installation packages, Q2 2025 — Q2 2026 (download)

The detected installation packages were distributed by type as follows:

Detected mobile apps by type, Q1 — Q2 2026* (download)

* Data for the previous quarter may differ slightly from previously published data due to certain verdicts being retrospectively revised.

While the number of newly discovered banking Trojan variants fell precipitously, they continued to dominate the threat landscape as they did in Q1. Notably, the share of Creduz malware family among identified banking samples has grown significantly despite low activity in victim telemetry. This discrepancy suggests the threat actors are actively iterating on the malware — likely testing new features or bypasses — by generating a high volume of builds before staging a broader campaign.

Share* of users attacked by the given type of malicious or potentially unwanted apps out of all targeted users of Kaspersky mobile products, Q1 — Q2 2026 (download)

* The total may exceed 100% if the same users experienced multiple attack types.

Within the adware category, the sharpest declines were observed in the HiddenAd and MobiDash families. Meanwhile, the proportion of users targeted by Trojan-Dropper malware increased, primarily driven by surges in banking droppers such as Trojan-Dropper.AndroidOS.Banker and Trojan-Dropper.AndroidOS.Mamont. The corresponding drop in the Trojan-Banker category is partially explained by a shift in tactics: several banking Trojans which are now being packed were subsequently reclassified as droppers.

TOP 20 most frequently detected types of mobile malware

Note that the malware rankings below exclude riskware or potentially unwanted software, such as RiskTool or adware.

Verdict	%* Q1 2026	%* Q2 2026	Difference in p.p.	Change in ranking
Backdoor.AndroidOS.Triada.ag	7.09	9.35	+2.25	0
DangerousObject.Multi.Generic.	5.84	5.65	-0.19	0
DangerousObject.AndroidOS.GenericML.	5.51	5.25	-0.26	0
Trojan.AndroidOS.Boogr.gsh	2.15	3.33	+1.18	+9
Backdoor.AndroidOS.Triada.z	3.08	3.23	+0.15	+3
Trojan-Banker.AndroidOS.Mamont.hl	1.10	2.48	+1.38	+22
Trojan.AndroidOS.Fakemoney.v	3.44	2.31	-1.13	-2
Trojan-Spy.AndroidOS.Btmob.e	0.00	2.27	+2.27
Trojan.AndroidOS.Triada.fe	2.98	2.18	-0.81	0
Trojan-Dropper.AndroidOS.Banker.dd	0.01	2.16	+2.15
Trojan.AndroidOS.Triada.hf	2.23	1.93	-0.29	+1
Backdoor.AndroidOS.Triada.ad	1.40	1.93	+0.53	+8
Backdoor.AndroidOS.Keenadu.a	2.73	1.88	-0.85	-3
Backdoor.AndroidOS.Triada.ab	1.72	1.79	+0.07	+2
Trojan-Banker.AndroidOS.Mamont.iv	1.03	1.63	+0.60	+16
Trojan.AndroidOS.Generic.	1.32	1.47	+0.15	+7
Backdoor.AndroidOS.Triada.ae	1.76	1.44	-0.31	-2
Trojan.AndroidOS.Fakemoney.ej	0.00	1.43	+1.43
Trojan.AndroidOS.Triada.ii	2.07	1.41	-0.66	-5
Trojan-Spy.AndroidOS.Agent.asa	0.02	1.38	+1.36

* Unique users who encountered this malware as a percentage of all attacked users of Kaspersky mobile solutions.

The distribution of top malware families in Q2 largely mirrors the rankings from the previous reporting period. Newer variants of the Mamont banking Trojan climbed the leaderboards, displacing older iterations. This shift points to ongoing, active development of new variants by the threat actors behind the malware.

Mobile banking Trojans

In Q2, the total volume of Trojan-Banker applications dropped sharply compared to the previous quarter, totaling 93,574 installation packages.

Number of installation packages for mobile banking Trojans detected by Kaspersky, Q2 2025 — Q2 2026 (download)

Against the backdrop of this trend, the distribution shifted heavily toward Creduz Trojans. However, as noted earlier, this shift was not reflected in real-world attack metrics: virtually the entire leaderboard by proportion of targeted users continues to be dominated by diverse Mamont variants.

TOP 10 mobile bankers

Verdict	%* Q1 2026	%* Q2 2026	Difference in p.p.	Change in ranking
Trojan-Banker.AndroidOS.Mamont.hl	3.27	11.13	+7.86	+6
Trojan-Banker.AndroidOS.Mamont.iv	3.08	7.33	+4.25	+6
Trojan-Banker.AndroidOS.Mamont.mv	0.00	5.12	+5.12
Trojan-Banker.AndroidOS.Agent.ws	3.78	4.99	+1.22	+2
Trojan-Banker.AndroidOS.Mamont.mg	0.35	4.71	+4.36	+62
Trojan-Banker.AndroidOS.Faketoken.pac	2.56	4.10	+1.54	+6
Trojan-Banker.AndroidOS.Mamont.jo	15.75	3.73	-12.02	-6
Trojan-Banker.AndroidOS.Mamont.mc	0.83	3.51	+2.67	+26
Trojan-Banker.AndroidOS.Mamont.lf	0.00	2.79	+2.79
Trojan-Banker.AndroidOS.Agent.eq	0.89	2.58	+1.69	+23

* Unique users who encountered this malware as a percentage of all users of Kaspersky mobile security solutions who encountered banking threats.

Piloto de Arrancada · Paraná, Brasil · Desde 1988

Maurício
Debarba

Mais de três décadas de reta, largada e paraquedas. De um Maverick em terra batida em Dois Vizinhos (PR) aos 407,50 km/h de um dragster slingshot — esta é a história de um dos nomes mais constantes da arrancada brasileira.

36+

Anos de pista

200+

Troféus

180

1º lugares

407,5

Km/h (recorde)

Ver linha do tempo Galeria de fotos Instagram

01 · Quem é

A história por trás da largada

Nascido em São José dos Pinhais, na região metropolitana de Curitiba (PR), Maurício Debarba descobriu a paixão por velocidade ainda adolescente. A primeira corrida oficial veio em 1988, em Dois Vizinhos, perto de Cascavel — uma arrancada em terra batida, sem autódromo, ao volante de um Ford Maverick. Foi ali que ganhou o primeiro troféu de uma coleção que hoje passa de 200 peças.

Migrou para o autódromo de Cascavel e, no início dos anos 1990, chegou ao Autódromo Internacional de Curitiba, em Pinhais — palco da maior parte da sua carreira. Ali, pilotando um Opala turbo apelidado "Trovão Azul" (motor recuado, pneu slick, óxido nitroso), quebrou o recorde da categoria com 12,50s nos 400 metros, superando a marca anterior de 13,10s.

A migração para os dragsters — os "tubulares" ou "gaiolas" — veio por uma questão de custo de preparação. Passou pelas mãos de mecânicos históricos da arrancada nacional, entre eles Vilmar Comelli ("Italiano") e João Alexandre de Abreu (PowerTech), quebrando recordes de categoria e ajudando, nos bastidores, a preparar a própria pista de Curitiba.

"Nós ficamos muito satisfeitos, porque fizemos o recorde da categoria... não me lembro de ter perdido uma corrida." — Maurício Debarba, sobre a parceria com Vilmar "Italiano" Comelli

Ao longo da carreira, competiu em Top Alcohol (até 1999), Dragster Slingshot (2000–2004), voltou em 2005 com um Top Alcohol de motor traseiro e chegou a testar um Funny Car de quase 2.900 cavalos administrado pela equipe Race Force. Hoje comanda sua própria estrutura, a Debarba Drag Racing / Debarba Racing Store, em São José dos Pinhais.

Ficha do piloto

• NomeMaurício Debarba
• OrigemSão José dos Pinhais, PR
• Início1988
• EquipeDebarba Drag Racing
• Loja / marcaDebarba Racing Store
• CategoriasOpala Turbo, Dragster, Top Alcohol, Slingshot, Funny Car
• Recorde 402m6,80s
• Recorde 201m4,26s
• Vel. máxima registrada407,5 km/h
• Patrocínio históricoMilitec Brasil

02 · Vídeo

Lendário piloto DEBARBA — 30 anos de dragsters no Brasil

Um retrato em vídeo de três décadas de arrancada: largadas, recordes e a trajetória de Maurício Debarba nos dragsters brasileiros.

Assistir no YouTube

03 · Trajetória

Linha do tempo na pista

Da terra batida ao asfalto do autódromo — os marcos, recordes e capítulos que constroem a carreira de Maurício Debarba na arrancada.

Acompanhe no Facebook

1988

Primeira corrida — Dois Vizinhos (PR)

Estreia em arrancada de terra batida, ao volante de um Ford Maverick, na região de Cascavel. Primeiro troféu da carreira.

Estreia

~1990

Chegada ao Autódromo de Curitiba

Passa a competir no Autódromo Internacional de Curitiba (Pinhais), com o Opala turbo "Trovão Azul": motor recuado, pneu slick e óxido nitroso.

Base de carreira

1990

Recorde de velocidade — 407,50 km/h

Marca histórica em dragster slingshot, um dos números mais altos já registrados por Debarba na arrancada nacional.

Recorde

12,50s

Recorde de categoria — Opala Turbo

Nos 400 metros do autódromo de Curitiba, supera a marca anterior de 13,10s ao volante do "Trovão Azul".

Recorde de categoria

1992–93

Parceria com Vilmar "Italiano" Comelli

Novo dragster tubular quebra o recorde anterior de 10,76s, cravando 10,67s. Cerca de dois anos de domínio quase absoluto na categoria.

Recorde de categoria

1990s

PowerTech e o Dragster Light

Como gerente da loja de João Alexandre de Abreu, ajuda a preparar a estrutura de concreto e os painéis do autódromo de Curitiba, com apoio de Flávio Chagas. Recebe um Dragster Light e depois assume os dragsters maiores da equipe.

Bastidores

1990s

Capotamento em Interlagos

Pilotando o mesmo slingshot do recorde de 1990, capota nas curvas do "S" do Senna após acelerar além do previsto — e segue de volta aos boxes com o próprio carro, virando um dos episódios mais lembrados da carreira.

Episódio marcante

até 1999

Ciclo em Top Alcohol

Anos de destaque competindo na categoria Top Alcohol, uma das mais rápidas da arrancada brasileira, antes da virada para o slingshot.

Categoria

2000–2004

Ciclo em Dragster Slingshot

Novo capítulo em carros abertos de configuração slingshot, mantendo o nome entre os pilotos de referência do país.

Categoria

2005

Retorno com Top Alcohol motor traseiro

Após período fora das pistas, volta com um dragster Top Alcohol de motor traseiro, com chassi em aço-cromomolibdênio que pertenceu a André Takeda.

Retorno

2000s

Experiência em Funny Car

Testa um Funny Car de quase 2.900 cv administrado pela equipe Race Force, preparado pela Power Plus, disputando etapas do Paranaense de Arrancada — uma experiência nova após anos em carros abertos.

Categoria

2011

18º Festival Brasileiro de Arrancada

Confirmado na categoria Drag Top Álcool, ao lado de nomes como Thomas de Pauli, Alejandro Sanchez e Sidney "Grandão" Frigo, no Autódromo Internacional de Curitiba.

Evento nacional

~2014

Novo dragster e patrocínio Militec Brasil

Estreia dragster preparado pela equipe Speed Unlimited, com patrocínio da Militec Brasil — o mesmo carro usado para bater o recorde de 2016.

Patrocínio

2016

Recorde no Velopark (RS) — 6,80s

6,80s nos 402 metros e 4,26s nos 201 metros, atingindo 270 km/h. Um recorde que, segundo o próprio piloto, seguia de pé anos depois.

Recorde

2019

2º Festival Brasileiro de Arrancadas — Velopark

Última corrida documentada da carreira competitiva, com um 3º lugar no Velopark, Rio Grande do Sul.

Última corrida

2026

Exposição de Carros — Shopping São José

De 1 a 9 de agosto, apoio da Debarba Racing Store ao Encontro Drive Club, reunindo carros clássicos, personalizados e projetos especiais na Praça de Eventos.

Evento atual

04 · Marcas e Títulos

Recordes que ficaram na pista

Números levantados na reta: tempos, velocidades e o acervo de troféus construído em mais de três décadas de arrancada.

407,50

Km/h — recorde histórico

Marca alcançada em dragster slingshot, uma das velocidades mais altas já cravadas por Debarba em pista.

6,80s

402 metros — Velopark, 2016

Tempo recorde no quarto de milha, alcançando 270 km/h ao final da reta.

4,26s

201 metros — Velopark, 2016

Recorde complementar de meia-reta, registrado na mesma etapa de 2016.

12,50s

400m — Opala Turbo, Curitiba

Recorde de categoria com o "Trovão Azul", superando a marca anterior de 13,10s.

10,67s

Dragster tubular — anos 1990

Recorde de categoria na parceria com o mecânico Vilmar "Italiano" Comelli, batendo os 10,76s anteriores.

200+

Troféus — 180 em 1º lugar

Acervo construído ao longo de mais de 30 anos de competições em autódromos por todo o Brasil.

05 · Categorias

Por dentro das categorias que pilotou

Popularmente lembradas como "Top Fuel Slingshot", as categorias de arrancada disputadas por Debarba seguem nomenclatura técnica própria no Brasil — do dragster aberto ao funny car fechado.

Opala Turbo (Trovão Azul)

Carro de rua adaptado para a arrancada, com motor recuado, pneu slick e óxido nitroso. Ponto de partida da carreira em Curitiba.

Dragster Tubular / Light

Chassi em treliça de tubos, mais leve que os carros de rua adaptados, usado para bater os primeiros recordes de categoria.

Top Alcohol

Categoria de dragster movida a metanol, entre as mais rápidas da arrancada nacional — disputada por Debarba até 1999 e retomada em 2005.

Dragster Slingshot

Configuração clássica de dragster aberto com o motor posicionado atrás do piloto — o mesmo carro do recorde de 407,5 km/h e do capotamento em Interlagos.

Funny Car

Carro fechado por bolha aerodinâmica, com cerca de 2.900 cv — experiência pontual em parceria com a equipe Race Force.

Top Alcohol Motor Traseiro

Retorno de 2005, com chassi em aço-cromomolibdênio, disputando o campeonato paranaense de arrancada.

06 · Evento Atual

Exposição de Carros no Shopping São José

Encontro Drive Club 🚘🔥

A paixão por carros toma conta do Shopping São José! De 1 a 9 de agosto, a Praça de Eventos recebe carros clássicos, personalizados e projetos especiais que carregam história, estilo e personalidade — uma experiência para toda a família e para quem vive o universo automotivo.

• 📅 De 1 a 9 de agosto
• 📍 Praça de Eventos — Piso L1, Shopping São José
• 🎟️ Entrada gratuita, no horário de funcionamento do shopping
• 🏁 Realização: KDV 2K18 — Kingdom Vision Fest

Apoio

• ▸ Debarba Racing Store
• ▸ Força Livre Motorsport
• ▸ RAW
• ▸ Bali Hai

07 · Galeria

Galeria de fotos da exposição

Registros da Exposição de Carros — Encontro Drive Club no Shopping São José, e momentos da carreira de Maurício Debarba nas pistas de arrancada.

Dragster Slingshot · Pista

Largada · Autódromo de Curitiba

Paraquedas aberto · Chegada

Box · Preparação

Encontro Drive Club · Shopping SJ

Troféus e recordes

Funny Car · Race Force

Debarba Racing Store

Registro não oficial de uma visita à exposição, feito por @RDSWEB. O álbum completo com as fotos está publicado no Facebook — confira todos os cliques em alta resolução.

Ver galeria completa no Facebook

Football fans wagered more than US $14 billion on the FIFA World Cup through prediction markets Polymarket and Kalshi, a Bellingcat analysis has found.

On the crypto-based Polymarket, which provides more information about individual trading accounts than its rival American site Kalshi, we also found that just 1% of users collected the vast majority of winnings during the tournament.

Users traded on almost 60,000 outcomes across both sites during the competition, betting on everything from the sponsor of the Golden Boot winner to whether Cristiano Ronaldo would shed a tear during a Portugal match. 

The World Cup, held in the US, Canada and Mexico over June and July, was forecast to be the biggest betting event in history, with a predicted $50 billion in wagers. 

Unlike traditional sports betting sites, prediction markets resemble stock exchanges where users trade, via an order book, on whether a real-world event will happen. Prices fluctuate based on what the market believes the probability of that event is. The sites charge fees on each sports trade.  

The prediction market industry has faced criticism over its vulnerability to insider trading, potential market manipulation and concerns about fueling unregulated gambling. The Wall Street Journal also reported in May that a small number of individuals using algorithmic trading models were taking home an outsized share of winnings.

This would appear to align with Bellingcat’s World Cup analysis, where a small percentage of accounts made most of the winnings. However, the level of detail we were able to obtain did not allow us to see accounts that had utilised algorithmic methods.

Both Polymarket and Kalshi make events and volume data available for programmatic extraction – making it useful for open source analysis. Bellingcat’s data analysis examined all 104 matches as well as the World Cup winner event that was hosted on each platform.

On Polymarket, users traded a total of $10 billion ($5.7 billion on individual games and $4.3 billion on which country would win). The largest game on Polymarket was the Spain vs Argentina final ($212 million), followed by the France vs Spain semi-final ($165 million) and the England vs Argentina semi-final ($142 million). 

On Kalshi, users traded a total of more than $4.3 billion ($4.1 billion on the games and $200 million on the winner).

Bellingcat’s analysis also found that 1% of Polymarket trading accounts collected 86% of all winnings during the World Cup, and the bottom 50% of winners shared just 0.1% of profits. The typical winning account on Polymarket made $21, while the typical losing account lost $32 (measured by the median, which is less affected by a handful of exceptionally large wins and losses). More than 12% of traders (14,500) who bet on two or more games lost every bet. The Polymarket account that won the most across all games made a profit of more than $13 million, while the biggest loser lost $11.6 million.

We were unable to run the same win-loss analysis for Kalshi because trading account overviews are not publicly available.

The top teams, by trading volume, across both sites were Argentina ($1.068 billion), Spain ($876 million) and France ($836 million). The top players were Argentina’s Lionel Messi ($40 million), France’s Kylian Mbappé ($36 million) and Norway’s Erling Haaland ($16 million).

How We Calculated the Volume

Polymarket displays the actual traded volume on its site, the total US dollar amount of shares bought and sold since the market started.

Kalshi does not display the traded volume. Instead, it shows the notional volume, which counts every contract traded at the maximum payout value of $1. This means that a token bought for $0.20 will be presented as $1 extra in a user’s displayed volume. This makes the total monetary volume appear higher on Kalshi’s website. To achieve a fair comparison between both platforms, we implemented a heuristic to reconstruct Kalshi’s markets’ volume. We used the daily average price for each market over their duration and multiplied it by the number of contracts traded on that day, the sum of which gives us the values used in this piece. We applied this formula for the more than 21,000 World Cup markets. 

---

Data scraping was supported by Oxylabs’ Project 4β.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

The post Will Ronaldo Cry​? World Cup Fans Bet Billions Through Prediction Markets appeared first on bellingcat.

Statistics on Malware Distributed to the Financial Sector In the June threat analysis for the financial sector, phishing was the most prevalent attack method in Attack Stage 1, while droppers/downloaders (distribution tools that download additional malware) were the most prevalent in Attack Stage 2. Infostealers were identified in the third attack stage, indicating that multi-stage […]

This investigation is a collaboration between Bellingcat and New Zealand news site The Press. You can read The Press’ piece here. 

Content warning: This article discusses non-consensual sexually explicit content and child sexual abuse material.

In 2024, a former track and field coach in Boston, Massachusetts, was sentenced to five years in jail for attempting to trick and extort more than 100 women, including student-athletes he coached, into sending him intimate photos. 

According to the 2021 criminal complaint, Steve Waithe stole photos from some of the student-athletes’ phones under the pretence of “filming their form” at practices and meets. He also approached some victims via fake online accounts, telling them he had found their images on a forum site called “leakedbb.com” (“LeakedBB”) and offering to help them remove these photos if they provided more images for “reference”. 

Authorities said Waithe also hired and paid another man in October 2020 to hack into the Snapchat accounts of women he coached or had other relationships with in an effort to steal and distribute nude images online. 

In one post, according to the US Attorney’s Office, Waithe wrote: “Does anyone want to trade nudes? I’m talking girls you actually know. Could be exes or whatever. I have quite a few and [am] down to trade over snap[chat] or something.” 

Legal documents do not name the sites on which Waithe distributed these images, but Bellingcat found a cached version of a November 2020 post with that exact wording on LeakedBB – the same site he allegedly used to try to trick victims. Another cached LeakedBB thread posted a few months later shows the same user offering to trade nudes of athletes, including “a lot that I actually know”.

Such posts were not unusual on the site: multiple archived pages show the forum’s users either requesting Snapchat hacks or offering to help others hack Snapchat accounts, sometimes for a fee. 

In the criminal case against Waithe, the ownership of LeakedBB is never discussed, but a Bellingcat investigation can reveal that payment streams, company records and website domain information appear to lead back to one individual: Jitendra Maharaj, a Christchurch-based former pilot and co-founder of a cryptocurrency start-up, Pay It Now (PIN), which reportedly billed itself as the “Stripe of crypto payments”. 

Our New Zealand publishing partner The Press sent an email to Maharaj on June 4 outlining our findings in detail and inviting him to respond. Maharaj did not reply to this. 

However, by June 6, LeakedBB was down. As of publication, the website remains inaccessible. 

The Press later received an email from a Christchurch-based lawyer representing Maharaj, who said their client was in Fiji for a family member’s funeral. The lawyer requested that we wait until his return on June 23. 

When The Press visited his residence – a two-storey family home in Christchurch’s affluent Aidanfield suburb – on June 25, Maharaj said he did not know who was behind LeakedBB or operated it and that he was not sure if the website was down. 

He said he did not respond to the email queries and had not spoken to his lawyers about them because “all the evidence against me just sounded really weird” and it seemed like there was “some kind of targeted attack out on me” based on “manufactured evidence or something that’s pointing me to this garbage”. However, he refused to comment on the record about most of the specific evidence linking him to the site and referred these questions to his lawyer. 

He also claimed that he had been contacted by people “trying to harass me to get me to send them money”, but declined to provide details on the record.

Despite a further extension of the deadline until July 6 – more than a month after we first reached out – Maharaj and his lawyer had not provided any statement directly addressing the specific evidence linking him to the site as of publication. 

PIN, the company Maharaj co-founded, did not respond to The Press’ requests for comment. However, there is no suggestion that PIN has any knowledge of or involvement in LeakedBB.

Profiting Off ‘Leaks’

LeakedBB was set up in 2019 and built a sizeable following over the next seven years, averaging an estimated two million visits a month from March to May this year. The board statistics shown on LeakedBB’s homepage in May displayed 2.2 million registered users and more than 2.6 million posts.

Google’s Transparency Report shows it received more than 95,000 individual requests for over 350,000 pages on LeakedBB to be delisted from search results. This resulted in Google de-listing more than 169,000 pages from its search results, according to the report. 

Shortly after the site went offline, a Reddit post noting the outage and asking for alternatives trended in the “hot” section of a piracy subreddit, accumulating almost 700 votes in a week. In response to a question by one commenter asking what the site was, another person replied: “Not only did it have ‘onlyfans’ content, also amateur, asian, arabic, celebrity and other hacked phone/icloud content from other sites.”

This comment accurately summarised some of the content on the site. In LeakedBB’s early days, it had sections for other types of “leaked” content such as computer programmes and eBooks. But within months, the forum’s discussions were almost exclusively about pornographic images and videos that members claimed had been leaked – implying that it was non-consensual, hacked or stolen content.

The most popular section on the forum contained content that claimed to be from sites such as OnlyFans and Fansly, which, if shared without the original creators’ consent, would be a violation of their intellectual property. 

Reba Rocket, co-owner and chief operating officer of Takedown Piracy, a company that helps both adult performers and private individuals remove non-consensually shared explicit media, said sites like LeakedBB cause financial harm to legitimate content creators.

“People would not shove a DVD into their coat pocket and walk out of the store – that’s something tangible that they know they’re doing something wrong, whereas watching something on the internet for free doesn’t have that same connected moral,” she said. 

Other sections on LeakedBB featured threads requesting or promoting content that often appeared to show women who did not have anything to do with the adult industry, which the posts claimed were leaked, hacked or even obtained through blackmail. 

One post advertised images of girls from 29 US states: “There’s names and Facebook information if you want that,” the member, “Master Leaker”, posted. “There’s also two girls that got blackmailed into sending more nudes as well!”

In the “Requests” section, users shared clothed images of women or social media handles of potential victims, and asked if others had leaked content of them. In one recent post looking for a “Florida Milf”, a user wrote: “She may go by the name [redacted]. Looks like the daughter graduated from [redacted]. Anyone have content of her? Sex tapes?” 

Some users also posted nude or intimate images of women they had found elsewhere, asking for help finding out their real identities. “Who is she?” or “Can anyone ID?” were some common questions in the posts. 

Non-consensual intimate image sharing (NCII), colloquially referred to as “revenge porn”, is far from new. It is a known problem on Reddit, where, in 2022, a BBC investigation found “thousands” of such images being shared despite the platform’s attempts to crack down on the issue. 

LeakedBB, however, seemed to take the opposite approach: instead of trying to moderate or prevent users from posting what appeared to be NCII, it sought to profit from and reward it. 

Except for preview images, most of the content users shared in the “leaks” section was behind a paywall and could only be accessed with memberships costing up to US$99.99 or by redeeming credits. 

The site rewarded members with credits for posting “leaked” content, as well as when other members spent credits to “unlock” their content. These credits could be used to access links that users could otherwise only view with a paid upgrade, or redeemed for cryptocurrency at varying rates (the most frequent contributors had the option to cash out the equivalent of up to $0.15 for each thread they posted). 

There was also an annual Christmas contest, with last year’s total prizes worth over $4,000 in cryptocurrency for users who posted or liked the most threads.

Rocket said LeakedBB had “damaged many people”, including clients of her company. “Those specific clients are not in the adult industry,” she said, “but LeakedBB seemed more than happy to share their non-consensual content”. 

The “leaks” were often posted with women’s purported real names, locations and social media accounts, as well as preview images showing their uncovered faces. One poster said sharing a woman’s social media details “adds to the experience”. 

“For me, it makes my jerk-off sesh feel more personal, as if she’s an actual person I know rather than a moviestar/pornstar,” the post said.

There were more than 80 responses to this thread, mostly thanking the original poster for sharing the content. One of them, however, claimed to be the woman shown in the images: “Please remove this link. These photos were illegally stolen from me. This constitutes revenge porn and violates US law. Police are already involved. Not only is it illegal but just gross.”

Allison Mahoney, the founder and managing attorney at ALM Law in New York and Colorado, told Bellingcat she received calls about cases involving NCII “all the time”. 

“It kind of amazes me, given the amount of media attention this has gotten over the years, that people are still engaging in this type of abuse so cavalierly,” said Mahoney, whose firm specialises in providing legal services for abuse survivors and children harmed in welfare systems.

Mahoney and Rocket agreed that sites sharing NCII often had real-world implications for victims, especially when images were posted alongside personal information, including names, contact information and professions. 

“We have clients who … their children were kicked out of Catholic school, or they lost their mainstream job, or relationships ended, or families cut them off simply because content was posted online without their consent and viewed by others,” Rocket said. 

Mahoney said online abuse can turn into offline abuse when victims have their personal information, like their name, profession and contact information, posted with their images.  She has seen clients who had strangers show up at their homes or places of work, threatening their physical safety – a situation she said was “really terrifying”. 

In July last year, LeakedBB closed a marketplace it had hosted for more than five years, which allowed users to sell leaks and services to each other. Lucifer NightStar, the administrator account on the site, said there were allegations of people selling “UA [underage] material”, which was “not something we want on [LeakedBB]”.

On one section of the forum, which was specifically for sharing content from other sites that hosted leaked pornographic content, LeakedBB had a disclaimer: “Please note that posting any content on any one below the legal age of 18 is against the law. We have a zero tolerance policy on such things and your account will immediately be banned / reported.”

But this warning did not appear on other sections of the forum, including those featuring threads of “amateur nudes” described as having been leaked. Some threads on the forum, which remained accessible shortly before the entire site was taken down, also described images of “young teens”. 

While it is not known if those descriptions are accurate, in a recent post on Reddit a person asked for help taking down non-consensual photos they said were taken when they were a minor, hacked from Snapchat, and posted on LeakedBB, among other sites. 

“I am in school to become a teacher and searched my name on google. If you go down a bit these websites come up,” they wrote. “I am so devastated and can’t believe this has happened to me.” 

While speaking to The Press outside his residence on June 25, Maharaj said that when it came to publishing non-consensual pornography and child sexual abuse imagery, “It should be obvious anyone’s against that.”

Who Is Lucifer NightStar?

Lucifer NightStar was the username for the only account with the title of “Administrator” on the LeakedBB forum. This user posted FAQs for the site and almost every forum announcement throughout its history. 

The URL of this account’s profile page shows the user ID (UID) of “1”. According to documentation for MyBB, a free and open source forum software that LeakedBB has credited for powering the site, the first user of the forum is assigned the UID “1” and has super administrator privileges – meaning their account cannot be deleted, banned or otherwise altered by regular administrators.

While the profile did not state the user’s location, it did show a local timestamp based on the user’s timezone settings, which matched GMT+12 – a timezone used in several countries in Oceania, including New Zealand and Fiji. 

Lucifer NightStar’s recent posts generally avoid mentioning non-consensual intimate imagery, focusing on administrative updates and issues, troubleshooting and the annual Christmas contest. However, in the first few months of the forum’s existence, the user posted a thread with a “LeakedBB Exclusive” of “leaked Kiwi girls”.

In another discussion thread from 2020, Lucifer NightStar vouched for a user’s ability to “influence” another member’s ex-girlfriend to share nudes.

Maharaj did not respond to The Press and Bellingcat’s question about whether he was Lucifer NightStar. However, one of the administrator’s posts led us to a clue pointing to Maharaj’s possible connection with LeakedBB. 

Logica Ltd and MyBBplugins

In one post in May 2021, responding to a user reporting problems paying with Apple Pay, Lucifer NightStar shared a screenshot of what the payment screen should look like. A company name was visible in this image: “Logica LTD”.

New Zealand company records show that Logica Limited was registered by Maharaj in February 2021, just months before this post. The company address is also in Christchurch, where Maharaj lives.

(Note: This is a different company from Logica Partners Limited, based in Auckland, which has no apparent connection with Maharaj or LeakedBB and is unrelated to this investigation.) 

The records from the New Zealand Companies Office show that Maharaj has been the sole director of Logica Limited since its incorporation. He stated on his LinkedIn profile that he was self-employed as the CEO of Logica NZ from May 2020 to August 2021. 

(Maharaj’s LinkedIn profile appears to have been deleted between June 13 and June 15, after The Press and Bellingcat’s initial enquiries and during the period his lawyer said he was in Fiji attending a family member’s funeral.)

But that was not the only connection to Logica Limited. On May 4, 2022, a YouTube user with the display name “LeakedBB” uploaded a video on how to pay for memberships on the site. This video was also embedded on LeakedBB’s homepage. 

The video showed how users could pay by credit card. When they clicked to purchase a membership, LeakedBB would redirect them to another website to buy a digital avatar pack with a price corresponding to their selected membership tier. 

After purchasing this “referral product”, users were encouraged to leave a comment and a positive rating to receive an “extra bonus month”. Archived versions of the website show view counts in the tens of thousands for some of these avatar packs. 

The thumbnails of the “digital avatars” as well as their price and description, as shown in the video, were identical to those shown on the archived version of a site, logica.nz, which is recorded as Logica Limited’s website on OpenCorporates. This site also lists “Logica LTD” in its copyright information at the bottom of its landing page. 

(Bellingcat last accessed a live version of the video on June 15. By July 1, we noticed that the video had been removed by the uploader.)

In a forum thread on LeakedBB dedicated to explaining alternative ways to pay for membership, hundreds of users posted that they had just purchased the “Mystic Avatar Pack” or the “Pixel Avatar Pack” to gain access to the site. One user included screenshots of their purchase, showing the site URL to be “logica.nz”. Other users also stated that they had made the purchase on this website and were waiting to receive their upgrades.

This website’s landing page now displays only a note stating that it is under maintenance. However, according to archives captured by the Internet Archive, it was still selling “digital avatar packs” in March 2025.

This type of payment structure not only conceals the nature of the transaction from the payment processor (as non-consensual content violates most platforms’ terms of service), but it also hides the transactions for the user, as payments are not described as being made to “LeakedBB” on bank statements.

When asked about the links between LeakedBB and Logica Limited, Maharaj only told The Press at the doorstep interview on June 25 that “Logica was my company. I cannot say what happened there right now”.

According to the New Zealand Companies Register, Logica Limited is in good standing, with its most recent annual filing submitted by Maharaj in March 2026. 

The Domain Name System (DNS) records of LeakedBB revealed another connection that seems to point back to Maharaj. Using online investigations tool DNSlytics, we viewed DNS records for the website and found that in 2020, the MX (mail exchange) record for LeakedBB.com was set to LeakedBB.net. An MX record is the mail server set up to accept emails for that domain. For LeakedBB.com, this was later changed to ProtonMail. 

While the WHOIS ownership of LeakedBB.net is obscured, we found it on a list of sites that had DNS certificates issued by another site, mybbplugins.com. A DNS certificate is used to prove ownership of a domain and requires an administrator to validate that certificate. 

According to WHOIS records from cyberthreat intelligence platform DomainTools, mybbplugins.com was publicly registered to Maharaj from December 2011 to February 2019, after which the registrant information was redacted.

The same site also issued a DNS certificate for a domain bearing Maharaj’s name (jitendramaharaj.com) as well as two domains that include part of his first name, jit-pay.cc and thejitshow.com. DNS certificates for these domains were issued between 2016 and 2021, according to free Certificate Transparency monitoring site crt.sh. Both “leakedbb” and the domain names linked to Maharaj’s name (i.e. “jitendramaharaj”, “jit-pay” and “thejitshow”) were also used as subdomains for mybbplugins.com, records from DomainTools show. 

Another link appeared when we inspected the code of the oldest saved archive of the payment screen on LeakedBB, from November 2019, which showed a ProtonMail address associated with the PayPal form at the time with a string of seven digits as the username. 

This string of seven digits is an exact match for what appears to be part of a Fiji-based phone number listed on WHOIS records for websites registered to Maharaj’s name including mybbplugins.com, from 2008 to 2011. It is unclear whether Maharaj was using this phone number in 2019, by the time LeakedBB was set up, and a different Fiji-based phone number was used with his name when the registration for mybbplugins.com was renewed in 2016.

Explore some of the links between Maharaj and LeakedBB:

From MyBB to LeakedBB

Bellingcat also found several other apparent connections between Maharaj and other applications hosting adult content. 

An account with the username “Jitendra M.” has been posting on the MyBB community forum since 2008, with the account ID originally using the username “Darkmew”. An archived capture of this account’s profile information showed a date of birth and a location in Fiji. 

This date of birth matches the one listed on a Facebook profile Bellingcat found under Maharaj’s name. His LinkedIn profile also shows that prior to moving to Christchurch, he worked in Nadi, Fiji, and he has listed addresses in the city for some of the domains registered to his name, as well as an email with a Fijian domain. This user also mentions that they are a pilot. 

Jitendra M.’s profile bears a “former staff” label, indicating that he used to work for MyBB. A previous commit (save) of a file containing details of MyBB team members shows that the full name associated with this account’s user ID and username was “Jitendra Maharaj”, and his website was listed as jitendra-maharaj.com. 

Archived versions of this site show photos and details that match those from Maharaj’s public social media profiles and interviews. For example, a 2011 capture shows that he mentioned being a pilot at a company called Pacific Sun. Pacific Sun was later rebranded as Fiji Link, and Maharaj’s LinkedIn profile, before it was deleted, stated that he worked for Fiji Link from 2009 to 2015. A blog post on the site also refers to mybbplugins.com as the author’s “newest endeavour”.

Very shortly after joining the MyBB community forum in Feb 2008, Jitendra M. asked about using MyBB for “warez” (an internet slang term for pirated digital content) and/or adult content. He stated that he was “interested in using it for a [sic] adult forum”. 

During this time, he also posted asking about streaming videos from a server and how to use a PayPal account without a credit card for “people putting money into my account for services I provide”. In late 2008, Jitendra M. purchased a web domain, reaperscrypt.info, which Wayback Machine archives show hosted pornographic content while it was online in 2009. This domain was publicly registered to Maharaj from November 2008 to January 2010. 

In 2013, he posted about selling the mybbplugins.com domain. However, as previously mentioned, Maharaj’s name was still publicly registered as the owner of the domain until February 2019, when registration data was redacted.

Bellingcat was able to view Facebook and Instagram accounts under Maharaj’s name and showing his profile picture in early May. These accounts painted a picture of a family man, with his public photos mainly showing his wife and children. His Facebook account had been either deleted or made private by May, and his Instagram account, while still active, has not been updated since 2013.

Archives of an X account using the same username as Maharaj’s Facebook and Instagram accounts also show several posts from November 2019 promoting LeakedBB. 

The “Darkmew” username that Jitendra M. originally used was also used for a GitHub account which hosts a repository described as the “official repository for Pay it Now – PIN Token”. This account, which now redirects to an account with the username “JitMaharaj”, has also forked (or copied) two apps created by other people: one to create a subscription platform “like onlyfans.com” that uses cryptocurrency for payments; the other designed to scrape and report illicit content from LeakedBB.

These forked repositories were among 38 visible on JitMaharaj’s account on June 17, but by July 1 – after a June 22 query from The Press asking Maharaj whether he owned this account – there were only 25 repositories listed on this account. The two repositories mentioned above were among those removed.

Maharaj did not respond to questions about whether he owned any of the accounts or domains mentioned in this section.

‘Hiding Behind Screens’

Mahoney said that successfully removing clients’ images from platforms like LeakedBB was a time-consuming task. “Some sites, usually the sites hosted overseas, will just ignore the request and won’t take them down,” she said.

In the US, which accounted for almost half (40 percent) of LeakedBB’s web traffic in May, the Take it Down Act recently came into effect. The new federal law requires platforms to quickly remove non-consensually shared intimate imagery when it is reported.

However, there has been little discussion of the law on LeakedBB. One user asked in the “Help” forum how this act would affect the site and its members back in October 2025, but Lucifer NightStar never responded to this post.

Rocket said having content removed for her US-based clients could be difficult when the platforms were based overseas: “A lot of it depends on where the platform is hosted, who runs their ad network and who is monetising – who their payment processors are,” she said. 

LeakedBB accepted cryptocurrency payments through NOWPayments, a cryptocurrency payments gateway based in the Netherlands and Estonia. The purchase page for its subscription plans, which allowed users to gain unrestricted access to the site, redirected to a NOWPayments purchase screen to transfer cryptocurrency to LeakedBB. 

In response to questions from Bellingcat, NOWPayments confirmed that LeakedBB’s activities violated its terms of service. The payments provider said it had deactivated LeakedBB’s account and blacklisted the platform immediately, as of June 4. 

LeakedBB did have a form for people to request that their content be taken down under the Digital Millennium Copyright Act (DMCA), a US copyright law. However, this required victims to submit personal information such as a physical address and a business email address, and stated that it would reject requests that used email addresses from free services like Google and ProtonMail. Such details appear to go beyond those required for DMCA takedown requests on other sites: for example, Google only requires a first and last name, and an email address from any domain.

In one Reddit thread discussing the difficulty of removing content from LeakedBB under the DMCA, someone commented: “Some of this seems fairly standard, some of it seems like it’s designed to make people not request a takedown for fear of doxing [sic] themselves.”

On the page to submit DMCA takedown requests, LeakedBB also stated that successful requests would lead to them removing content hosted on their servers, but not links to third-party hosting providers – which is how a large portion of the content was made available to the website’s users. 

In New Zealand, where Maharaj is based, posting intimate imagery without consent is illegal under the Harmful Digital Communications Act. People face up to two years imprisonment or a fine up to NZ$50,000 (US$29,200), while for a company, the fine can be as high as NZ$200,000. 

Netsafe is the only approved body in the country that handles complaints under this act. The agency’s chief online safety officer Sean Lyons told The Press that the law was quite novel and other jurisdictions were “envious” when it was enacted – it was able to respond to generative AI technology that didn’t exist when it was written, and gave New Zealand courts powers to issue takedown orders, even in other countries.

Still, Lyons said the law had its limitations: it was mostly intended for use where one individual was harming another, and if the responsible party was overseas, the law’s efficacy largely relied on responsible platforms doing the right thing. 

“There are times when within our process, we will have contacted platforms or hosts and they will have said, ‘Who the heck are you?’…[Or] ‘We know what we’re doing, we are quite comfortable with what we are doing, and we don’t give a stuff about what it is that you are telling us, or about New Zealand law, or about the harm.’”

Mahoney and Rocket agreed that current laws were limited in their effectiveness against sites like LeakedBB. 

“The fact of the matter is there are places where … until there is an enforceable international law, that content is going to be available forever, which means there is a risk of it being shared forever,” Rocket said. 

Mahoney said image-based abusers have also become more sophisticated over time: “Technology is advancing, and the law is always playing catch-up,” she said. 

But she suggested that identifying those responsible for the abuse could have a deterrent effect: “The anonymity that people have hiding behind screens really contributes to this and emboldens people to act in ways that are very abusive to people.

“If people understand that there’s a risk that their identity and their bad behaviour will be revealed, the hope is that it will curtail some of this and dissuade people from engaging in this type of conduct, which is so, so harmful to the victims.” 

If you are a victim or know anyone who is affected by image-based abuse, resources and support are available through StopNCII.org.

---

Galen Reich and Melissa Zhu from Bellingcat and Michael Wright from The Press contributed to this article. 

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

The post Identifying the Crypto Entrepreneur Linked to Popular Forum Trading in ‘Leaked’ Nudes of Women appeared first on bellingcat.

China-linked UNK_MassTraction targets US and Canadian universities through Roundcube flaws, stealing sessions and opening access to research mail servers.

Canadian hacktivist Aubrey Cottle, known as Kirtaner and once linked to Anonymous, gets 18 months for a 2021 Texas GOP website cyberattack.