OSINT Investigation Traces Iranian-Linked Campaign of Assassination Bounties Targeting Trump
Summary
DarkOwl researchers trace a campaign of online assassination bounties targeting Donald Trump across Iranian-linked domains, social media, and state-aligned channels, including amplification by the Handala hacking group.
Key points
- Researchers identified an onion-site fundraiser claiming more than $300,000 raised and promoting a $1 million campaign; its QR codes directed donations to Bitcoin and Monero wallets.
- IRGC-associated Telegram channels and Iranian platforms Eitaa and Rubika promoted the campaign, with domestic posts appearing before broader Telegram amplification.
- Campaign domains included killtrump[.]info, killtrump[.]me, and killtrump[.]ir; researchers linked their hosting to Iranian providers and observed rotating top-level domains as sites went offline.
- The Handala hacking group announced a $50 million reward for killing Trump and Benjamin Netanyahu; the article says the offer remained active on Handala’s domain at publication.
- Iranian state-aligned media and senior regime-linked figures echoed or amplified threats, including a reported $10 million reward promoted by the Islamic Resistance in Iraq.
- The article cites the U.S. conviction of Iranian intelligence agent Asif Merchant in a foiled murder-for-hire plot, noting the case had progressed beyond online rhetoric to operational planning.
Article Details
- Attack Vectors
- The campaign was promoted through dark web onion sites, Telegram channels, Iranian domestic social media platforms, and Iranian news outlets.
- The campaign sites solicited donations through Bitcoin and Monero wallet QR codes.
- Handala publicly attached itself to the assassination-bounty campaign through a statement reposted by Mehr News.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | killtrump[.]info | Campaign domain promoted by IRGC-associated channels and linked to Iranian hosting infrastructure. |
| DOMAIN | killtrump[.]ir | Campaign domain promoted on Eitaa and reported as hosted on an Iranian IP address. |
| DOMAIN | killtrump[.]me | Campaign domain promoted by Sabereen News and reported as hosted on an Iranian IP belonging to Netmihan Communication Company Ltd. |
| IPV4 | 185[.]143[.]234[.]235 | Iranian IP address hosting the killtrump.ir campaign site. |
People
Asif MerchantAlso known as Asif Raza Merchant; convicted in connection with a foiled plot to assassinate U.S. politicians and government officials, including President Trump.Benjamin NetanyahuIsraeli prime minister identified alongside Donald Trump in Handala’s announced reward.Donald TrumpU.S. president identified as a target of the reported assassination-bounty campaign.Hossein ShariatmadariIranian journalist and political commentator who published remarks widely read as a reference to retaliatory action against President Trump.
Threat Actors
Vendors
Products
EitaaThe campaign was seeded on Iranian domestic social media platforms Eitaa and Rubika — both widely used inside Iran — days before being promoted on the above-mentioned Telegram channels, suggesting a deliberateRubikaThe campaign was seeded on Iranian domestic social media platforms Eitaa and Rubika — both widely used inside Iran — days before being promoted on the above-mentioned Telegram channels, suggesting a deliberateTelegramThese threats span multiple layers of the internet — from dark web onion sites and encrypted Telegram channels to mainstream Iranian state-aligned media — and reflect both grassroots extremist sentiment and coordinated
Countries
IranAs tensions between the United States and Iran continue to escalate, DarkOwl researchers have observed a marked increase in online threats targeting the life of President Donald Trump.IraqOn July 16th, 2026, the Islamic Resistance in Iraq (Arabic: المقاومة الإسلامية في العراق) — an Iran-backed umbrella coalition of Shia militant factions operating under the strategic direction of the IRGC Quds Force —IsraelUnited StatesAs tensions between the United States and Iran continue to escalate, DarkOwl researchers have observed a marked increase in online threats targeting the life of President Donald Trump.