DOJ Seizes Domains Used for Iranian ‘Terrorist Propaganda’ Operations

U.S. Justice Department Seizes Iranian Government-Backed Propaganda Websites

The Department of Justice announced Thursday it had seized four internet domains allegedly used to spread Iranian government-backed disinformation targeting American audiences. The domains, according to federal prosecutors, were operated by individuals and entities connected to Iran’s Ministry of Intelligence and Security.

The websites reportedly disseminated propaganda, amplified pro-Iranian narratives, and worked to undermine confidence in U.S. institutions. They have since been taken offline and now display FBI-controlled seizure notices.

“Iran, the leading state sponsor of terrorism worldwide, used the seized domains to dox and harass dissidents and journalists, incite violence against Jewish communities, and spread Tehran’s anti-American propaganda,” said Assistant Attorney General for National Security John A. Eisenberg.

Attorney General Pam Bondi emphasized the real-world implications of such operations, stating that information displayed on these websites “can incite real-world violence.”

The four domains—Justicehomeland.org, Handala-Hack.to, Karmabelow80.org, and Handala-Redwanted.to—allegedly posed as independent news outlets or advocacy platforms while actually functioning as fronts for coordinated Iranian influence operations. Officials described the action as part of a broader campaign to counter Tehran’s expanding use of cyber tools to shape public opinion abroad, especially during periods of heightened geopolitical tension.

According to the DOJ, the websites pushed messaging aligned with Iranian government interests, including content designed to inflame political divisions within the United States and shape American perceptions of U.S. foreign policy.

The seizure comes amid growing concern about Iran’s integrated use of cyberattacks and online propaganda. One of the seized domains, Handala-Hack.to, was reportedly used to claim responsibility for a disruptive cyberattack on Stryker, a Michigan-based medical device manufacturer. The attack temporarily affected the company’s global network and internal systems, reportedly wiping data from thousands of devices.

While Stryker stated it had contained the disruption and found no evidence of malware affecting patient services, cybersecurity experts warn the incident signals a possible escalation in tactics, combining operational disruptions with broader messaging campaigns. This hybrid approach represents a concerning development in Iran’s cyber operations strategy.

The Justice Department alleges that through its domains, Handala Hack published personally identifiable information about Israeli military and government personnel. The group reportedly posted names of Israeli military personnel and urged “people of the Axis of Resistance” to “respond to these Zionist pigs yourselves.”

In another concerning incident, the group claimed to have stolen hundreds of gigabytes of confidential data from members of the Sanzer Hasidic Jewish community, including what they described as “documents of financial cooperation, witchcraft ceremonies, and secret correspondences with [Benjamin] Netanyahu.”

This domain seizure represents the latest chapter in the ongoing digital conflict between the United States and Iran. Both nations have increasingly employed cyber operations as tools of statecraft amid broader regional tensions. For Iran, online influence campaigns provide a relatively low-cost method to project power internationally while potentially avoiding direct military confrontation.

Cybersecurity experts note that state-sponsored influence operations have become increasingly sophisticated, often blending legitimate content with manipulated information to create more credible-seeming narratives. This approach makes such operations harder to detect and counter.

The FBI Baltimore Field Office is investigating the case in coordination with the FBI Cyber Division as the Justice Department moves forward with prosecution. This action highlights the growing focus on countering foreign influence operations that target American audiences, particularly as the United States approaches a presidential election year when such activities typically intensify.

The seizures also demonstrate the evolving legal and technical tools U.S. authorities are deploying to disrupt foreign information operations before they can significantly impact public discourse or national security.