OSINT platform free trial
Try the world's most popular OSINT platform for free. Elevate your enterprise investigations with unmatched accuracy.
Get Free Trial
This FDD OSINT analyst cracked Iran’s bizarre attempt to fund an assassination… via Wordpress.
"Trump can no longer sunbathe in Mar-a-Lago… a micro-drone might target and strike him right in the navel!" – Mohammad-Javad Larijani, adviser to Supreme Leader of Iran Ayatollah Ali Khamenei. [Source: Newsweek]
On February 14th 1989, Iran’s Ayatollah Ruhollah Khomeini declared Salman Rushdie’s novel The Satanic Verses was “in opposition to Islam”. Spoken by a mufti (Islamic scholar), the Ayatollah’s decree constituted a formal legal opinion; that any believer killed in an attempt to harm the author would die a martyr. Rushdie, and his publishers, were effectively sentenced to death – the most famous fatwa issued to date.
Fast forward 30 years, and in June 2025, Iran's top Shia cleric Grand Ayatollah Naser Makarem Shirazi issued a fatwa declaring U.S. President Donald Trump (and Israeli Prime Minister Benjamin Netanyahu) as moharebeh, or ‘waging war against God’ .
Many in the West assume a fatwa is always a call for violence. This isn’t supposed to be the case. In Islamic tradition, a fatwa is simply a mufti’s advisory legal opinion or religious guidance. The vast majority - rulings on prayer practices or everyday ethical questions - are nonviolent, nuanced and consultative, part of the fabric of Muslim life and history. However, it's unsurprising the term has acquired its shorthand meaning in Western discourse. Fatwas encouraging recycling or blood donation are easily overshadowed by despotic regimes across the Islamic world calling for the killing of feminists, outlawing Pokémon (twice), or declaring snowmen “un-Islamic”.
Yet when a fatwa’s subject is an international author, foreign president or the South Park team, an obvious question arises. How can a death-penalty fatwa be implemented against a foreign individual, in a foreign country with no Sharia courts, muftis or requirement to adhere to the decree at all? Financial incentive, of course.
If covert networks, militant groups or lone wolf extremists manage to carry out the assasination, a ‘reward’ would be heading their way via bank transfer, hawaladars, or other secret methods of distribution. Predictably, after Grand Ayatollah Shirazi’s Trump/Netanyahu fatwa, Iranian clerics initiated a fundraising campaign. One single cleric, Mansour Emami from Iran's West Azerbaijan Province, had offered 100 billion tomans (approx. $1.14 million) for Trump's death alone.
"It is really terrifying… any activity can now be easily labeled as 'corruption [of] earth,' while formerly the same actions would be ruled as softer crimes like 'propaganda against the regime'... Neither the new law nor the fatwa is in favor of the defendants.” – An anonymous Tehran-based Iranian lawyer. [Source: ABC News]
Many of these clerics had in fact issued individual concurrent Trump/Netanyahu fatwas; they all come, moreover, from the hardline wing of Iran's politics. Khamenei-regime cleric Alireza Panahian called on Muslims to kill Trump and Netanyahu in retaliation for their threats on Khamenei, while 98-year-old ultraconservative Ayatollah Hossein Noori Hamedani made his own decree. These were published by Iran's semi-official Tasnim News Agency alongside a bill that has prompted alarm from Iranian lawyers and human rights activists. Anyone, the bill states, taking "any action or cooperation in carrying out political, cultural, media and propaganda activities… or preparing or publishing false news… that typically causes public fear and terror, creating division or harming national security" are guilty of mofsed-e-filarz, or "corruption of earth." This ‘crime’ is punishable by execution at worst, or 10 to 15 years of imprisonment at best - and keeps its definition as vague as possible to cast a wide net.
After the passing of this law, and following increases in protest, Iranian executions have risen to an average of four a day.
So, although borderline ridiculous from a Western perspective, Iran experts like those at the Foundation for Defense of Democracies (FDD) see the Trump/Netanyahu fatwa as the foreign policy element of a push by Iran’s ultraconservative, hardline factions. A fatwa derails any chance of peace talks with the US, and keeps their agenda at the forefront - and in the news.
“The Islamic Republic’s clerical class is raising the stakes... With this fatwa, which contains some blatant invitations to violence as a religious commandment, Tehran aims to inspire everyone from its transnational terror cadres to lone-wolf radicals… It is also signaling to countless dissidents within Iran that violence will be employed more often against protestors who chant against the supreme leader.” – Behnam Ben Taleblu, FDD Iran Program Senior Director and Senior Fellow. [Source: FDD]
Outrageous claims of a fatwa fund reaching $40 million are a part of this hardline narrative. The source of this figure - $40,286,867, to be exact - is an Iranian website: ‘thaar[.]ir’. The page’s tone was best described as “unhinged”. Its operators, the ‘Blood Covenant’ group, claimed to campaign against "U.S. state terrorism" delivering the funds it raises to assassins "who carry out the sentence of justice. (trans.)" Citing Quranic verses about financial obligation alongside major clerics’ denouncements, thaar.ir claimed to be crowdfunding a fatwa.
Reports about thaar.ir credited a key discovery to Max Lesser and Maria Riofrio, analysts with the Foundation for Defense of Democracies. The two, reports state, unmasked “an Iranian national” and former propaganda network employee as the operator behind ‘Blood Covenant’.
Max reached out to us to tell us more about this discovery process - and how OSINT, and OSINT Industries, were the key.
"I guess it's a threat. I'm not sure it's a threat actually, but perhaps it is." – U.S. President Donald Trump on the fatwa against him. [Source: Newsweek]
Meet Max Lesser, CCTI Senior Analyst on Emerging Threats (and his doomscrolling intern).
Max Lesser works as a Senior Analyst on Emerging Threats at FDD’s Center on Cyber and Technology Innovation (CCTI). This unit focuses on how technology innovation can advance US cybersecurity, and help counter attacks on the American federal government, private sector and friendly countries throughout the world. They do so through academic research on adversary strategy, scientific experimentation and interdisciplinary study by talented analysts like Max. Their aim: to balance the risks of tech in the wrong hands, with the power of tech in the right ones.
“If I can’t use OSINT Industries, it probably isn’t worth it…” – Max Lesser, Senior Analyst on Emerging Threats, Foundation for Defense of Democracies. [Source: FDD/OSINT Industries]
CCTI analysts make regular use of OSINT, and OSINT Industries. Having “heard our name enough to want to check [us] out”, Max wanted some of the success he was seeing others have with our tool. Before long, he was referred to OSINT Industries by colleagues in the cybersecurity world, and now describes our OSINT platform as “one of the best out there”.
In his previous life, Max served as head of U.S. policy analysis and engagement at Darktrace Federal, a cybersecurity company that specializes in AI’s potential to combat attacks (including nation-state attacks) on US federal clients. Max’s research and insight into foreign malign influence on US politics has also been referenced by OpenAI itself, and made its way into The New York Times, Wall Street Journal, and NBC News.
It’s safe to say, when it comes to the Iranian regime’s cyber presence - and investigating it with OSINT - Max knows exactly what he’s talking about.
On July 8th this year, Max’s intrepid intern was doing what international security nerds do to relax: doomscrolling. This time, malicious Iranian activity on Twitter (X) was the focus, and before long a remarkable website popped up on her feed.
The page had large, dark backgrounds with red accents. A huge donation-counter was displayed above a graphic with Arabic text and a target across Donald Trump’s face. Religious terms like “حکم عدالت” (judgment of justice) or “mohareb” (enemy of God) mixed with fundraising calls-to-action like “Help the cause” and “Donate your money now”.
The site footer read “THIS CAMPAIN [sic] IS NOT FUNDING TERRORISM. IT IS FUNDING THE FIGHT AGAINST US STATE TERRORISM.” The URL banner read thaar[.]ir.
The Man Behind Thaar[.]ir: Who Created the Crowdfund?
Max immediately began a technical investigation into the fatwa crowdfunding site that was about to dominate the news. OSINT was a natural starting point to building a domain history timeline.
Thaar[.]ir first appeared in DNS records on July 2nd 2025. This was mere days after the June 29th Trump-Netanyahu assasination fatwa. Astonishingly, behind the curtain, thaar[.]ir used the same open-source content management system (CMS) as millions of sites across the web.
It turned out Tehran’s assassination fund… was basically a WordPress blog.
Wordpress automatically creates an author page when site content is created. Sure enough, it had done the same for thaar[.]ir. The creator’s username, displayed on this page, was ‘H_abbasifar.’
A quick Google dork on this username, predictably, led to an Eitaa account. This identified the site’s creator as Iranian. Put simply, Eitaa (ایتا in Farsi) is the Iranian WhatsApp - or Telegram. When Telegram faced access restrictions in 2018, Iranian authorities promoted local apps like Eitaa, Soroush, Bale, and Gap as domestic alternatives that comply with Iranian regulations, and - crucially - host data in-country. Eitaa claims it “doesn’t share data of its subscribers with any government or person”. However, the non-profit Open Technology Fund (OTF) has raised persistent issues with security on Iranian apps; Freedom House has likewise highlighted surveillance on domestic messaging apps when declaring Iran’s net ‘Not Free’.
H_abbasifar’s Eitaa profile featured the same logo that appeared on thaar[.]ir. Linked was a “cultural, artistic, and literary channel” using a variant spelling of the same username. More importantly, Eitaa displayed a full government name for the account owner: Hossein Abbasifar (حسین عباسیفر).
Max had identified Hossein Abbasifar (حسین عباسیفر) as the creator of thaar[.]ir.
From here, to the archives.
Max accessed an archived version of Abbasifar’s Eitaa channel from October 20th 2022. This instance displayed a different profile photo, one that showed the account holder’s face. Reverse image search on this image revealed a Clubhouse account - ‘h.abasifar’ - that also used Abbasifar’s likeness as a profile photo.
On Clubhouse, Abbasifar listed an email: econcul@gmail[.]com. Max’s OSINT work then connected this email to thaar[.]ir too.
Because Abbasifar had built his site on Wordpress, he had opened up an unexpected vulnerability. As Max explains:
“WordPress includes a REST API that allows various applications - like SEO tools, site analytics platforms, mobile apps, and custom front ends - to interact with the website. Although this API can be fully or partially disabled, or limited to specific endpoints, many developers leave it publicly accessible unless configured otherwise.”
Abbasifar had made this mistake. Thaar[.]ir had left its REST API endpoint public: thaar[.]ir/wp-json/wp/v2/users/2. Naturally, this endpoint showed metadata for user ‘h_abbasifar’. It also included a Gravatar URL with a SHA-256 hash - of Abbasifar’s email address.
Gravatar utilizes a system of hashed email addresses associated with each profile image. Max couldn’t reverse the hash, but ran a test to crack the code. By hashing econcul@gmail[.]com, he produced the exact same SHA-256 value.
The email linked to Gravatar, and Gravatar linked to the Wordpress site. Houssein Abbasifar was chain-linked to thaar[.]ir.
Between Two Ayatollahs: Tracking Abbasifar’s Email
An email address meant a search on OSINT Industries.
Searching econcul@gmail[.]com, h_abbasifar, and h_abasifar via OSINT Industries unearthed Abbasifar’s accounts on Telegram, Skype, X (Twitter) and Instagram. He also had accounts on Aparat and Virasty (Iranian local Youtube and X “knockoffs”, respectively).
Abbasifar’s Skype profile showed him seated at a desk, flanked by photos of two Ayatollahs: Ali Khamenei on the right, and his predecessor Ruhollah Khomeini on the right. Despite all his localized Iranian and Farsi-language accounts, Abbasifar’s LinkedIn profile lifted his location as North Bergen, New Jersey, USA. According to Max, this potentially provides him “a vehicle to pose as a U.S.-based person and approach Americans” who may be disgruntled with events in the Middle East, or the Trump regime.
OSINT Industries also alerted Max to breached data from Abbasifar’s accounts. Using Dehashed, a data-breach search tool, he searched for econcul@gmail[.]com. This pulled up records from the 2024 breach of Cutout[.]pro, a photo and content editing platform - and a critical twist in the thaar[.]ir investigation.
Max saw the IP address linked to Abbasifar’s leaked account - 5[.]112.76.118 - was registered to an Iranian cellphone provider. This confirmed Abbasifar was operating from inside Iran as recently as 2024, when the fatwa site was made.
It also intensified Max’s suspicions about a connection between Abbasifar and the Iranian regime.
On some of his (eminently accessible) socials, Hossein Abbasifar claimed to have worked with Islamic Republic of Iran Broadcasting (IRIB, Farsi: صدای جمهوری اسلامی ایران). Also known as Seda o Sima (Farsi: صدا و سیمای, lit. 'Voice and Vision'), the state-owned public broadcaster of Iran is better described by the FDD as ‘Tehran’s Propaganda Network’ - or, for its broadcasting of coerced confessions, ‘Torture TV’.
Abbasifar’s Clubhouse account listed him as director of Seda Media School, linking to a now-inactive site at heyat[.]school/seda. Max’s archived 2021 version showed this was a school for audio production, teaching students how to publish podcasts and radio shows. ‘Professor Abbasifar’, according to his profile, was teaching from his experience at Persian music station Radio Javan, and as a specialist at an IRIB Radio station.
“IRIB and its subsidiaries act not as objective media outlets but as a critical tool in the Iranian government’s mass suppression and censorship campaign against its own people.” – An anonymous – US Department of the Treasury Press Release on IRIB Sanctions, 2022. [Source: USDT]
The US, Canada and European Union have sanctioned IRIB for its activities as an organ of oppression.
Turning Point: How OSINT Industries Closed the Loop
“This… demonstrates how a combination of cyber threat intelligence (CTI) and OSINT can be used to identify malicious actors, including those seeking to mobilize violence through digital platforms.” – Max Lesser, Senior Analyst on Emerging Threats, Foundation for Defense of Democracies. [Source: FDD/Memetic Warfare]
Max told us he uses our tool in “almost every investigation” he embarks on. An email is “really gold”, but with OSINT Industries, even a small clue like a username, email address, or even a government name in a CSV file can be enough to get started on something big.
Google dorking played a part in this investigation, but Max was able to move far beyond what traditional tools and searches could find: data from Telegram, Skype, X (Twitter), Instagram, and - thanks to OSINT Industries’ wide international scope - Iranian platforms like Aparat and Virasty.
The implications for cyber threat intelligence (CTI) are obvious. In this case, OSINT Industries opened multiple avenues. It proved to be the turning point in finding out who crowdfunded a fatwa.
It was through OSINT searches that connected handles and led Max to relevant metadata that Hossein Abbasifar’s network was tied together. Ultimately, it was the Clubhouse account found via an OSINT Industries search that listed an email address. These final matches confirmed Abbasifar’s identity, closing the loop on thaar[.]ir, and drawing an Iranian state organ into orbit.
But what now? And how successful had Abbasifar’s campaign really been?
#BloodOath: Could a Fatwa Go Viral?
Hossein Abbasifar wasn’t about to stop when his fatwa site was taken down. As of July 12th, 2025, Max found his target remains at large - as undaunted as his Presidential target. Abbasifar’s ‘THAAR[.]IR Blood Oath (عهد خون) Campaign’ was still active on Eitaa. His posts continued to encourage donations, still intermixing religious and militant rhetoric with CTAs for a fundraising effort. One of his most recent posts shared an image of Hezbollah leader Imad Mughniyeh with Arabic text calling for Israel’s destruction.
Max took to Sprout Social for rundown of the hashtag ‘#عهد_خون’ - something like ‘#BloodOath’ in English. On X (Twitter) showed the campaign peaked at roughly 800 posts between June 10 and July 10, 2025. According to his analysis, this means that Abbasifar’s mobilization effort “briefly gained traction, and achieved limited success in circulating on at least one Western social media platform.”
For a brief time, crowdfunding a fatwa could have been trending.
To find out more about Max and the FDD’s work, visit:
Start your free enterprise trial
Get Free TrialReveal what's behind any contact, instantly.
We want to hear your story!
Inspire Others
Educate about what OSINT can do.
Positive Publicity
Share your success with the world.
Support #OSINT4Good
Be part of the OSINT story.
