🇮🇷 OSINT WWIII 🇺🇸

1/2 According to my assessment, between the January 8th and 9th, Iranian regime repression forces fired approximately 1.2 million rounds across Iran—mostly using Kalashnikovs, shotguns, machine guns, and pistols at close range. A large number of the wounded were executed with a final shot in hospitals while they were in stable condition. Regime forces also used several types of non-standard (non-issued) weapons in order to later claim during investigations that foreign elements (Mossad) were involved. The number of those killed is undoubtedly far higher than the 12,000 reported by Iran International and the 20,000 cited by other sources. (My estimate places the death toll at no fewer than 30,000 and possibly up to 50,000.) Most Iranian cities became deserted starting Saturday, the January 10th, and a form of martial law is effectively in place. Satellite dishes and residential receivers are being dismantled. The regime has distributed mobile phones, wallets, watches, and valuables belonging to killed protesters among its own forces. (The mobile phones are reportedly being wiped after inspection and undergoing software-based IMEI modification.) Many detained women were subjected to gang rape, followed by execution with a final shot..!! A large number of bodies that were shot in the face have been buried in mass graves. According to my information, this is confirmed in Rasht and Tehran. As of Wednesday night, there were still many unidentified bodies in three forensic medicine centers in Tehran. It is likely that 5,000 to 7,000 people were killed in Tehran, 3,500 to 5,000 in Rasht, and 2,500 to 4,000 in Mashhad and Isfahan. We still do not have confirmed information on the situation in many smaller cities, nor verified figures on arrests, injuries, and deaths. This lack of information is especially concerning regarding cities in Ilam Province (more than anywhere else), Kurdistan, Sistan and Baluchestan, and Shiraz. There have been reports of amphetamine use and several other narcotics among repression forces. Participants in the protests have reported a sharp escalation in the regime’s level of violence during this wave of demonstrations—particularly following the call by Prince Reza Pahlavi—including uniform clothing with leopard-pattern designs and new equipment, likely procured from China. In several cities, highly trained, muscular, tall forces were observed who were not Iranian. (At least 130 cities were involved in protests.) A significant portion of the killings was carried out by these foreign forces, who were likely transferred to Iran following the events of October 7, 2023, and the fall of the Syrian regime. Approximately 5,000 fighters from three IRGC-affiliated militia groups in Iraq reportedly entered Iran by bus and plane via Najaf and Karbala. In many cities, Iranian forces either handed over their weapons and refused orders to kill civilians, or fled. Rumors have circulated regarding the arrest of Hassan Rouhani and Javad Zarif, as well as the house arrest of Mahmoud Ahmadinejad, former presidents of the Iranian regime. Based on the information available to us, I consider such high-level arrests plausible, and it is even possible that a large number of senior security officials have been arrested or killed. The internet inside Iran has been reduced to an intranet, with only domestic websites and banking applications functioning. Since Thursday (yesterday), security and regime-affiliated individuals equipped with white SIM cards and internet access have once again become active online, indicating an effort by the government to engineer and manipulate social media networks. #Iran

On January 8th , in one of the small cities of Iran, the repressive forces took 12-15 people out of the city and asked them to take off their clothes. One of them resisted, and for that reason, they shot him from close range with a shotgun and killed him on the spot ... The other individuals, after being stripped naked, with a shotgun They were shot in the rectum... Two of them have lost their lives up to this moment as I'm speaking to you. All of the remaining individuals are living with colostomy bags and are in the hospital. Their digestive and reproductive organs have suffered severe damage, and they will have to live with the consequences of this savagery for the rest of their lives. #IranMassacre‌

A message painted on a wall in Iran reads: “Uncle Lindsey, your memory will always live in the hearts of Iranians.” @LindseyGrahamSC

The people of Iran extend their deepest condolences on the passing of Senator Lindsey Graham. For many Iranians who have spent years standing against oppression, repression, and violations of human rights, Senator Graham was a voice of support for freedom and justice. He repeatedly spoke about the Iranian people’s right to determine their own future and took positions against the oppressive actions of the Islamic Republic. At this difficult moment, we honor his memory and his efforts in defense of freedom, democracy, and human rights. We extend our condolences to his family, friends, colleagues, and the people of the United States, and we wish comfort and strength to all those mourning his loss. The memory of those who stood alongside the people of Iran in their pursuit of freedom will endure in history. @LindseyGrahamSC

Negotiating with the Iranian regime is a waste of time and only provides it with an opportunity to regroup and rebuild its capabilities. Lindsey Graham was reportedly in Ukraine shortly before his death, and there are questions being raised about the possibility of a biological attack…

I am deeply saddened by the sudden passing of Senator Lindsey Graham, a steadfast friend of the Iranian people and a proud defender of freedom. At moments when moral clarity was required, Senator Graham stood on the right side. When friends were seldom found, he stood alongside the people of Iran in their struggle against tyranny. He used his voice to ensure that the voices of those fighting for justice were heard in the halls of power. His support for Iran’s Lion and Sun Revolution earned him the title “Uncle Lindsey” among Iranians. He will be remembered with profound gratitude and deep respect. We extend our deepest condolences to Senator Graham’s family, loved ones, colleagues, and the people of South Carolina and the United States. May he rest in peace and may others carry on the fight for freedom.

The people of Israel and Iran have lost a good supporter. Senator Lindsey Graham passed away just 24 hours after visiting a factory in Ukraine, shortly after returning to the United States…!🥀

In its latest round of empty threats, the Iranian regime published the following individuals from its alleged assassination target list. Notably absent from the list are Russian President Vladimir Putin and Chinese President Xi Jinping.

Six months ago, tonight, Tehran went dark. All of Iran went dark. And into that darkness, millions of Iranians walked out of their homes anyway. January 8th and 9th were not just two nights of protest. They were the night Iran's silence broke. Millions came into the streets, into the squares, onto their rooftops — but the regime answered them with bullets. Tens of thousands of my compatriots were killed in those forty-eight hours. Tens of thousands more have been arrested, tortured, and sentenced to die since. They came out, determined and brave. I think of them every day. On those two nights I lost countrymen I will never get to meet. I do not hear a statistic when I hear the number 40,000. I see a son who did not come home to his mother. A daughter who will not sit at her family's table again. I think of each of them the way I would think of my own child, my own brother, my own sister. I carry the weight of every one of those names. But the families of the fallen I meet with, week after week, hearten our nation's will to carry on. Their children did not die in vain. They died for freedom, and they died with pride. History will remember what these men and women did; I will make sure of it. Like the resistance who stood against tyranny in occupied Europe, and like the revolutionaries who fought for liberty in America. But theirs was a particular bravery. They had no army, no air cover, nothing but the belief in what they stood for. They stood anyway. A united nation choosing to face the guns together rather than live one more day in fear. The men and women of the 8th and 9th of January will be remembered in Iran's history as the greatest generation that preferred to die free and standing than to live cowered on their knees. To the international community, I ask this: do not let a negotiating table in Geneva or Islamabad erase what happened in the streets of Tehran, Mashhad, and Kermanshah. They died for freedom. And when they are free, the Strait of Hormuz will open. The nuclear threat will end. And we will have true peace. I have told my compatriots: what you did on January 8th and 9th cannot be undone. Together, we will reclaim our country’s rightful place in the world, our national dignity, and honor the lives of our heroes. Now is the time to reassess, regroup, and rededicate ourselves to victory. We honor the fallen by finishing what they started. A free Iran is no longer a matter of hope. It is a matter of fact. And know that my brave compatriots are not just fighting for their own liberation but for the peace and stability of the world.

#Breaking At least one explosion has been reported in eastern #Tehran. A radar installation is believed to have been targeted.

While Iranian state media, aided by AI-generated content and amplification tools, claimed that millions of people attended the funeral of Iran’s Supreme Leader, Ali Khamenei, Reuters analyzed satellite imagery of the funeral site and concluded that the actual attendance was between 100,000 and 200,000 people. #Iran

📍3/3 Another part of the story of the training and presence of the PROTEI team in Iran. One of the 2021 emails shows that an AryanTel manager is asking Nima Eskandari, the manager of Telinsol, to arrange the preparations for the PROTEI training team's trip to Iran, per the CEO's instructions. In the continuation of this correspondence, Eskandari asks an individual named Vladimir at PROTEI about Russia's travel policy and the possibility of flying to Iran. This email chain is from 2021 and shows that the connection between AryanTel, Telinsol, and PROTEI continued from the initial negotiations in 2019 through 2021. Therefore, this correspondence is one of the clearest signs of the transfer of citizen-spying technology from the Russian company to the Iranian operator. In this context, Telinsol plays the role of intermediary. This British company, in correspondences related to equipment purchases, commercial proposals, coordination with PortaOne and PROTEI, and training planning, has acted as an intermediary and coordinator. Nima Eskandari is the manager of Telinsol. Of course, Citizen Lab has stated that no document of the final contract between Telinsol and AryanTel has been seen. Telinsol has also denied any involvement in assisting with digital espionage against Iranian citizens and stated that the review process for cooperation ended in September 2019. Which, of course, is a lie, and documents obtained from the hack show that this connection and coordination continued until 2021. 📍The PROTEI company is a Russian company established in 2002 with international activities. PROTEI has a special Russian branch called PROTEI ST or Special Technical Centre, created for working with Russian government and military institutions. These details are important for understanding the nature of the company; because they show we are dealing with a company that collaborates with the Russian government. This case needs to be examined more precisely and in greater detail. Right now, we know that AryanTel has obtained core network components and DPI from PROTEI. Documents also show that the received technology has been tested, and in those tests, successful limited bandwidth throttling, blocking of certain data services, and logging of internet usage were included. But we still don't know at what level this technology is being implemented. At the national level? It's not far-fetched. - Source: @AManafii

2/3 Documents show that in the IP Traffic Management section, it is stated that PROTEI DPI could classify user data to services such as WhatsApp, Facebook, or Twitter and limit the bandwidth or quality of service for that type of traffic; to the point where the service becomes unusable. Additionally, this system has the capability to limit bandwidth for specific websites or applications, block data traffic for specific sites or applications, and block data for specific users. In the obtained documents, there is a document titled Acceptance Test Protocol; a document that in technical projects is typically used to record acceptance tests. That is, the customer checks whether the product truly has the capabilities it was supposed to provide or not. In this case, one of the tests related to traffic management. According to Citizen Lab's review, the acceptance test document given to AryanTel confirms success in bandwidth throttling, blocking certain data services, and logging internet usage. Thus, this DPI project did not remain at the level of discussions and brochures; at least part of the capabilities were tested for AryanTel and the results were recorded. 📍In the AryanTel case, the only important matter is not the existence of DPI; rather, components such as HLR/HSS, SIAM, Shahkar, and systems related to legal interception systems are placed alongside each other. HLR/HSS acts like a shared identity registry and specifies who the user is, whether their SIM card is authorized or not, and what services they have access to. BSS holds account information, packages, payments, and subscriber services. DPI detects the type of traffic. When these components are connected to government systems, the possibility arises to combine "user identity," "service status," and "traffic type." This combination is what enables the government to know who the user is, in which network cell they are located, what services they have, what type of traffic they are consuming, and, upon receiving an order, what should be restricted or cut off.

📍1/3 The footprint of a Russian company has been hidden in Iran's internet infrastructure for years. The name of this company is PROTEI; a manufacturer of telecommunications equipment that leaked documents show is one of the most important technology suppliers in the Aryantel eavesdropping project. In 2022, after the disclosure of a collection of emails and internal documents related to the Aryantel project, researchers' attention was drawn to a case that remains largely unknown in Persian sources even today. These documents were handed over to Citizen Lab researchers for technical examination in October of that year. 📍Several years ago, Aryantel turned to a suite of surveillance and user espionage technologies sourced from the Russian company PROTEI—a DPI platform that enables the operator to identify users' internet traffic at the application level; in other words, to detect whether the user is using WhatsApp, Telegram, Facebook, Twitter, VPN, internet calls, online gaming, or file-sharing services. The documents indicate that this technology was intended to be connected to the legal eavesdropping and monitoring system of Iran's Communications Regulatory Authority; a system designed for the surveillance and access of responsible entities to users' communication information. To understand the importance of PROTEI, one must start with DPI. Ordinary network equipment typically looks only at the source address, destination, and some basic information to route data. But DPI operates more deeply. This system attempts to determine what type of service the data flow belongs to. It's not necessary to read the message content; even in encrypted communications, connection patterns, packet sizes, known destinations, traffic behavior, TLS features, and technical signatures can indicate that this connection is likely related to WhatsApp, VPN, Telegram, or an internet calling service. 📍In the Aryantel project, the significance of DPI lies precisely in this capability. If the system only sees the IP or domain, control is more limited. But when it can identify the service type, policy-making becomes far more precise. Instead of cutting off the user's entire internet, only WhatsApp slows down. Instead of blocking all traffic, only VPNs are disrupted. Instead of confronting the user with a filtering message, the desired service connects but is so slow and unstable that it's practically unusable—and then the Islamic Republic claims the internet is connected, even though it's not functional! #Iran

One of the banners displayed during Ali Khamenei’s funeral carried a message that underscores a broader argument: this regime is a terrorist regime and should be dismantled. #FinishTheJob

I hope this message reaches U.S. officials and the White House. They should recognize that negotiating with a terrorist regime and giving it time to rebuild its capabilities would be one of the greatest political mistakes a strong leader like President Donald Trump could make. - Tehran, now! @WhiteHouse @POTUS @marcorubio @JDVance

Happy 4th of July everyone.

Venezuelan authorities are reportedly estimating that the death toll from the devastating earthquake could range from 10,000 to as many as 100,000 people. If these figures are confirmed, this could become one of the deadliest natural disasters in the country’s modern history. - 🦶🏻Note: Please keep the people of Venezuela in your thoughts and prayers during this tragic time.

Venezuela has experienced two devastating earthquakes in just 60 seconds! According to initial reports published in the past hours, Venezuela has been confronted with one of the most severe earthquakes in its contemporary history. Two extremely powerful earthquakes with magnitudes of approximately 7.2 and 7.5 on the Richter scale occurred less than a minute apart. The epicenter of the earthquake has been reported in Carabobo State and around the city of Morón in northern Venezuela. The depth of the earthquake was relatively shallow (about 10 to 13 kilometers), which has intensified surface damage. The tremors were strongly felt in the capital, Caracas, as well as in several other states. Visual and field reports indicate the collapse of several buildings in Caracas, damage to urban infrastructure, and disruptions or outages in electricity and communications in some areas. Extensive search and rescue operations are underway in the affected areas. The cancellation of flights and damage to parts of Maiquetía International Airport near Caracas have also been reported. As of this moment, no official and definitive statistics on deaths and injuries have been released, but the United States Geological Survey (USGS) has warned that due to the intensity of the shaking and the population density in the affected areas, there is a likelihood of "high casualties and extensive damage." Following the earthquake, an initial tsunami warning was issued for some areas of the Caribbean Sea. This warning was later canceled or downgraded, and currently, no major tsunami threat has been reported. In terms of magnitude, this earthquake is comparable to the largest recorded earthquakes in Venezuela in recent decades, and some media outlets have described it as the country's most severe seismic event in over a century. The Caribbean region is a site of tectonic plate collision and slippage, and Venezuela has a history of devastating earthquakes, including the deadly 1812 Caracas earthquake.

Satellite imagery captured yesterday by Vantor shows the area surrounding Kerch and the strategically significant bridge spanning the Kerch Strait, a critical logistical link between Russia and the occupied Crimean Peninsula. The black smoke visible in the imagery originates from a large fire at an oil storage facility located near Kerch’s railway ferry terminal. The depot has been burning for an extended period, producing a dense smoke plume clearly visible from space. In contrast, the white smoke observed around sections of the Kerch Bridge appears to be generated by defensive smoke-screen systems. These systems are designed to obscure key bridge infrastructure from aerial reconnaissance, including drones and satellite-based observation, while also complicating targeting efforts during potential attacks. The imagery highlights the extensive protective measures currently being employed around one of Russia’s most important transportation corridors into Crimea. Since the start of the war, the Kerch Bridge has been subjected to multiple attacks and remains a high-value military and logistical asset. Additional satellite images included in this post show other bridge crossings and transportation links connecting the occupied Crimean Peninsula that have previously sustained damage or been destroyed, underscoring the ongoing vulnerability of critical infrastructure in the region.