Fars News Agency, affiliated with Iran’s Islamic Revolutionary Guard Corps (IRGC), reported on September 14 that a platform called Alaj had begun operating to identify and pursue Iranians abroad. The group says it wants to restrict access to financial resources, media platforms and citizenship-related services for people it labels supporters of sanctions and military strikes. Its promotional video sums up the approach: “You identify them. We take action.” Viewers are asked to collect information about social media users and send it to an organization whose operators and ultimate recipients remain unidentified.

Alaj’s website publishes photographs and personal details alongside social media accounts and political accusations. Its video shows viewers what to look for when examining an Instagram profile. The website publishes the dossiers; the video recruits people to help identify and report their subjects.

Promotion through government-affiliated media shows the importance the Islamic Republic places on policing citizens’ views and behavior, including outside Iran. An Instagram user’s job and place of residence become information to collect—and grounds for a threat of “action”—because of their political positions.

Identifying Instagram Users’ Whereabouts and Beliefs

One section of the video displays an Instagram profile with instructions to look at the account holder’s birthplace, occupation, place of residence, and “views and beliefs.”

The request goes beyond forwarding a post or video. Viewers are encouraged to connect an account to the person behind it and uncover details of their life—information that can help others locate and pressure them.

“They promote treason! You identify them,” the video urges. Individuals are branded with a political accusation before any process for assessing the allegations or allowing a response is explained.

The video also displays faces and examples of incoming messages. Alaj claims to review hundreds of reports a week. That figure has not been independently verified, but its presentation alongside the messages serves a clear purpose: to show viewers that others are participating and suggest their own reports will be followed up.

Personal Information in Public Dossiers

Part of Alaj’s homepage is dedicated to individual dossiers. Each is presented with a photograph, a name and a number, leading to what the website calls its “database of subjects.”

The examples examined include full names, places of residence, occupations, fathers’ names, Iranian national identification numbers, Instagram usernames and numeric account IDs. These details appear alongside accusatory descriptions of social media posts or participation in political demonstrations.

Instagram accounts feature prominently, but the available examples do not establish how many subjects are influencers, political activists or ordinary users. Publication on Alaj does not establish the accuracy of either the personal information or the allegations.

Bringing these details together creates a distinct risk. A real name, location, workplace and social media account collected in one dossier make a person easier to identify and target, even when some of that information was previously available in scattered sources.

“We Take Action”—But Who Does?

Alaj asks its audience to identify people and promises to handle the next step. The measures it advocates include prosecution, asset freezes and restrictions on consular services.

It does not explain which authority would carry out those measures. How are submissions checked? Who decides whether an accusation is valid? How can someone whose name appears on the website respond or have inaccurate information corrected? The pages examined provide no clear answers.

Governments in Europe and North America should take the promise of “action” seriously. Collecting opponents’ home and workplace details while threatening to act against them is a matter of physical safety. The Islamic Republic has a documented record of incitement abroad: in 2024, Swedish authorities said the IRGC had hacked a text-messaging service and sent thousands of messages encouraging revenge against people who burned the Quran. The evidence examined does not establish that Alaj is activating terrorist sleeper cells. It does establish an invitation to identify people and a threat to act against them. Authorities should not wait for an attack before investigating.

The killing of Salwan Momika in Sweden demonstrated that a threatened individual can be killed in the country where they sought refuge; the sources reviewed do not establish the Islamic Republic’s responsibility for his murder. In the cases of Hamid Nouri and Assadollah Assadi, however, courts had reached verdicts: life imprisonment for Nouri’s role in the 1988 massacre of political prisoners in Iran, and a 20-year sentence for Assadi’s role in a plot to bomb an opposition gathering in France. Both were subsequently returned to the Islamic Republic in prisoner exchanges. Returning people convicted of such crimes makes victims’ pursuit of justice negotiable and sends a dangerous message to the government: even a prison sentence can be bargained away by taking hostages. Securing hostages’ freedom is essential, but making hostage-taking profitable for the Islamic Republic puts others at risk.

The intimidation also reaches people who have not appeared on Alaj. Seeing other users’ personal details published and their access to services threatened can discourage people from speaking publicly or attending demonstrations. Publishing the dossiers and promising action can itself encourage self-censorship, regardless of whether the threatened measures are ultimately carried out.

The Infrastructure Is Visible. The Operators Are Not.

The reporting buttons on the homepage examined lead to alajadmin on Bale, an Iranian messaging service, and AlajGroupBot on Telegram. No dedicated reporting or document-upload form appears in that version of the page; its only form is a search box. Alaj promises confidentiality and encryption but does not explain who reads submissions, where records are stored, how long they are retained or which authority receives them.

At the time of examination, alajgroup[.]ir resolved to 195.28.10.108, an address in a range registered to Netafraz Iranian, a web-hosting provider. Its nameservers also belonged to Netafraz. The public domain lookup concealed the registrant’s details and did not provide a registration date. These findings identify the hosting infrastructure, not the people running Alaj.

The public website uses WordPress, the Elementor page builder and the Nader theme. The author identifier rgihr also appears on unrelated web-design portfolio pages, suggesting leftover demonstration material or content from an earlier site. References to ex[.]elead[.]ir in the footer, logo metadata and saved files provide another lead consistent with copying or moving the website, without establishing when that happened or who was responsible.

Neither these traces nor the hundreds of hosts associated with the same IP address establish a shared operator. Certificate records also show a Let’s Encrypt certificate for Alaj’s domain and its www version beginning August 24, 2026. Such a certificate enables encrypted connections and verifies control of a domain; it does not endorse the website or identify its operators. Assessing compliance with applicable sanctions restrictions requires knowing who the operator is. The available evidence does not establish knowing participation by Let’s Encrypt in Alaj’s activities.

The unanswered question is who controls the information once it is submitted. Ordinary hosting, WordPress and messaging accounts are enough to collect personal details and publish dossiers; sophisticated surveillance technology is not a prerequisite for the harm described here. Alaj exposes individuals while leaving its own decision-makers unidentified, making political expression a reason to investigate someone’s private life and threaten consequences. Publishing personal information and promising “action” raises the cost of dissent, but it does not erase the right of people in Iran and abroad to speak, protest or seek freedom from the Islamic Republic.