There are some places where OSINT is harder than others. Russia presents a challenge, and China too. But none are more challenging than OSINT in Iran. Iran, or the Islamic People’s Republic as it’s officially known, is host to one of the most restricted digital environments on Earth - and presents very different difficulties to most Western or even Asian contexts.
Iran’s digital landscape is one of the most controlled and censored in the world, shaped by hardline state policies. The government blocks foreign platforms, monitors online activity, and even occasionally imposes nationwide internet shutdowns - just to stifle discussion when the citizens need it most.
These conditions pose unique challenges (and opportunities) for OSINT investigators. Traditional OSINT entry points - like email, for example - aren’t going to give you the whole story. This guide will show you how OSINT Iran investigations work in practice: what data points matter most in the Persian world, how Iranian identifiers differ from other regions, and (most importantly) how cutting-edge OSINT tools can gather intelligence safely. برویم!
Background: The Challenges of Iran OSINT
According to watchdogs, internet freedom in Iran is still highly restricted; with authorities exercising “extensive censorship, surveillance, content manipulation, and extralegal harassment against internet users” on a regular basis. The government is definitely not above using underhand tactics to control online conversation and squash dissent, either. Here’s why OSINT in Iran is so challenging.
- Blocked Platforms: Major global platforms such as YouTube, Twitter/X, Facebook, and Telegram have been blocked or heavily filtered inside Iran for years. Instead, users either have to rely on circumvention tools, or seek out underground channels to stay in the know.
- The National Information Network (NIN): Government policies incentivise citizens to use the NIN instead of the normal net. A domestic intranet designed to function independently of the wider world wide web. The expansion of this network allows Iranian authorities to restrict access to international content - and push propaganda instead.
- Supercensorship: Censorship in Iran extends beyond simple blocking of websites. The government operates one of the most sophisticated internet filtering regimes in the world, using a combination of keyword filtering, DNS tampering, and network throttling to limit access to content it considers politically sensitive or “immoral.”
- Internet Blackouts: During periods of political upheaval, Iranian authorities have enacted dramatic internet restrictions, including total shutdowns. For example, nationwide internet access was reduced to virtually zero during violent protests in 2019 - with citizens left in the dark as to when it would come back on. This happened again amidst the June 2025 conflict; so expect the government to keep cutting off the net at will.
What to Expect From OSINT in Iran
But what does this mean for Iran OSINT? Well, in practice, expect:
- Unusual sources: When major platforms are blocked, netizens turn to unexpected places to communicate. Yet unlike China, Iran doesn’t have large-scale native-only platforms like WeChat. Expect your targets to use VPNs, or (if you’re doing journalistic investigations) share vital information through unusual channels.
- Unstable content: Sometimes, posts in highly-regulated environments have a habit of disappearing. The Iranian government has been known to force citizens to delete posts - or even delete them themselves. The more sensitive the content, the less likely it is to stick around for long, so archive everything.
- Diaspora media: Because domestic independent journalism faces severe restrictions, Iran OSINT investigators often have to supplement their SOCMINT with reporting from outside Iran. Diaspora media outlets and human rights organisations will often have information you can’t get from within Iran itself.
- Code switching: Code-switching - or adapting your language according to the audience - is already a common habit for Farsi-English bilingual Iranians. When censors could be reading every post, this goes into overdrive; citizens will use codewords, slang, and indirect references that only a native speaker will be able to parse.
Best Practices for OSINT in Iran
While Iran’s online environment poses challenges, there are practical methodologies that can get you results.
- Time-sensitive archiving: Capture and archive all your content quickly, before it disappears. Try archiving tools, or even use AI systems that capture the content for you to make things easier.
- Cross-source verification: The government is constantly pushing propaganda, so don’t trust everything you see. Always corroborate with independent reporting, satellite imagery, or trusted external sources outside Iran.
- Language fluency or native insight: Enlist native Farsi speakers or regional analysts to interpret nuances that automated translation tools sometimes miss.
- Risk-aware publishing: Avoid exposing specific individuals without consent - especially those inside Iran - to prevent harm from coming to them. The government has been known to harm its citizens regularly, and without consequence.
OSINT and Iranian Phone Numbers
Iranian phone numbers are one of the strongest identifiers available to OSINT investigators. As a rule, all Iranian numbers begin with the country code +98. So if you see those numbers, you know it’s Iran calling.
Then, this will be followed by a mobile or landline prefix; this tells you whether they’re calling on a cell or home phone, and which carrier they’re using.
- Mobile numbers use 09, followed by digits identifying the telecom provider. Major Iranian carriers include MCI (Hamrah-e Aval), Irancell (MTN), Rightel, and Shatel Mobile.
- Landline numbers use city-specific area codes. These are very useful for rough geolocation, and can help you confirm whether somebody’s actually calling from where they say they are:
- Tehran: 21
- Isfahan: 31
- Tabriz: 41
- Mashhad: 51
- Shiraz: 71
Even without access to usual internet platforms, phone numbers are still just as crucial for Iran OSINT. These digits often link directly to messaging apps, marketplace listings, business advertisements, and more, making them a powerful pivot point.
Iran SOCMINT: Social Media and Public Platforms in Iran
Despite the heavy censorship, social media still has value for OSINT in Iran. Even when platforms are blocked, many citizens just boot up circumvention tools such as VPNs, proxies, or tunnelling software designed to evade censorship. For instance, estimates suggest that at least 64% of Iranian internet users have relied on VPN access to reach foreign social media.
That means it’s still a big part of social and political life - and therefore not something an OSINT investigator can afford to overlook. Here are the platforms that have influence on the Iranian internet.
- Telegram: Historically, Telegram has been central to online communication; encrypted chats are super useful for mobilising away from prying eyes. Although Telegram was officially blocked in 2018, it’s only a quick tunnel away.
- Instagram: One of the most widely accessed foreign platforms inside Iran. Even though it remains intermittently banned, the restrictions were recently lifted… for now. However, it’s still subject to heavy censorship, with the government regularly interfering in what Persians can post - and punishing those who disobey.
- Whatsapp: Another platform that’s recently been opened up for Iranian users. Although the government does try and convince citizens to delete the app (citing conspiracy theories about Israel stealing data), it’s still a solid source for Western-style OSINT.
- X/Twitter: Since the new location detail feature was launched, one thing has become clear: Iran LOVES X. It’s a popular space for public debate; diasporic accounts will regularly post about a range of hot topics from currency crises to hit concerts. However, be mindful of government bots drowning out the genuine voices.
Staying Safe: Legal and Ethical Concerns for Iranian OSINT
This is perhaps the most important part of OSINT work in Iran. As one of the world’s most restrictive online environments, it’s also one of the world’s riskiest; legal and ethical issues should always be at the forefront of every investigator’s mind.
The Iranian government has built broad cybercrime and national security statutes - broad enough to be interpreted in unexpected ways. They’re used to criminalise certain types of online expression or information sharing: anything from posting about protests, to girls sharing pictures of their hair online.
And the punishments can be severe. For example, in 2025 President Masoud Pezeshkian signed the “Law on Intensifying Punishment for Espionage and Cooperation with the Zionist Regime and Hostile Countries,” making several online offences punishable by death. Posting the wrong thing could send a person to the gallows. These legal frameworks do not always distinguish between speech inside and outside the country either, which can create risks even for researchers working abroad.
Make sure you always protect your targets’, and your own anonymity. Only share content with their consent, and never share identifiable information about individuals inside Iran - especially dissidents, protesters, or vulnerable communities.
With Iran OSINT, the priority should always be to protect safety and privacy, even if it puts your investigation at risk.
