The Digital Security Helpdesk team, after several months of investigation, has discovered that the Islamic Republic is using a network of Telegram channels to distribute content related to pedophilia, non-consensual pornography, and the promotion of sexual violence. These channels serve two main purposes: first, to lure individuals interested in such content, and second, to organize them as a force to disseminate political propaganda and attack political dissidents, civil, and political activists.
We have evidence indicating that the content distributed in these Telegram channels is not only aligned with the overarching policies of the Islamic Republic, particularly in the realms of foreign and regional policy, but also, in many instances, functions as a tool for the dissemination of misinformation and disinformation. Furthermore, these channels actively publish content targeting civil and political activists.
These channels also distribute applications under the title “Bomber,” which allow users to send mass harassing text messages and disruptive phone calls to activists and opponents of the Islamic Republic, subjecting them to systematic and targeted psychological pressure and harassment.
Despite numerous documented instances of the Islamic Republic’s security and judicial forces taking action against individuals who publish content opposing the regime’s policies or lead alternative lifestyles, no action has been taken against this particular network. In fact, our investigation reveals that judicial and security authorities have actively blocked independent journalists, human rights lawyers, and internet freedom activists from reporting on and attempting to shut down these channels.
In one instance, after activists’ efforts to shut down the Telegram channel “Maktabkhaneh,” one of the most prominent of these channels, failed due to security forces’ intervention, the channel published a post attributing these efforts to “overthrowers” of the Islamic Republic and ridiculed and attacked them.
This post referenced a statement from the Iranian Cyber Police (FATA) declaring that it bears “no responsibility for programs that have been filtered.” This is despite the fact that FATA has repeatedly taken steps to block Telegram channels, Instagram accounts, and even Twitter accounts that, although filtered, were publishing content opposing the regime.
Even when the newspaper Farhikhtegan published a brief report on these Telegram channels, the author of the report and one of their children were attacked and threatened by the administrators of these channels.
Key Findings from the Research:
- A Vast and Coordinated Network: These Telegram channels and bots operate as a network, collaborating with each other and inviting their members to join other channels within the network. The administrators of these channels also quickly create new channels with similar content when one is shut down, and through this networked collaboration, they rapidly gain members. Although some channels have been blocked based on reports from internet freedom and security activists, Telegram needs to adopt a more proactive strategy to identify the full scope of this network, understand its infrastructure, and prevent the reactivation of these accounts, channels, and bots.
- Harassing Android Applications: The dissemination of Android applications titled “Bomber” aims to send mass SMS messages and phone calls to harass opponents of the Islamic Republic.
- Role in Promoting Propaganda and Misinformation: These channels actively spread false and misleading information in support of the Islamic Republic’s policies. Especially during regional crises, these channels coordinate posts that are anti-Israel and in support of the Islamic Republic.
- Attacks on Opponents and Civil Activists: These channels disclose the private information of political and civil activists and encourage their members to attack these individuals. The attacks include threats, harassing phone calls, and even public humiliation of the victims.
- Judicial and Security Immunity: Despite ample evidence of these channels’ involvement in distributing sexual, violent, and misleading content, the judicial and security authorities of the Islamic Republic have not only refrained from pursuing these channels but have also used threats and pressure to obstruct efforts by journalists and civil activists to expose these networks.
- Use of Concealment Techniques: These channels use various methods to avoid being blocked by Telegram, such as placing links to sexual content in the comments of posts and directing users to Telegram bots.
- Widespread Human Rights Violations: By publishing sexual and violent content, particularly against children, these channels seriously violate human rights and are being used as tools for suppressing political and civil opponents of the Islamic Republic.
Aligned with the Regime’s Broader Policy in Disseminating Misinformation
One of the primary strategies of these channels is spreading false and misleading information. Although they do not present themselves as news sources, they actively coordinate the dissemination of misinformation, especially during times when the Islamic Republic faces regional challenges, such as military engagements abroad or conflicts with Israel and the United States. These posts frequently glorify individuals who have died in these conflicts, amplifying the regime’s narrative and supporting its policies.
For example, on August 13, 2024, the channel “Tavileh Khodadoust” reported the death of one of Iran’s “military advisors” in Lebanon using language similar to that of Tasnim News Agency, which is closely affiliated with the Islamic Revolutionary Guard Corps (IRGC).
In this post, while announcing the death of one of these advisors, it states: “Milad Beidi, a member of the Iranian military advisory team, was martyred in last night’s attack by Zionist regime fighter jets on southern Beirut. He was the son of a martyr.”
These Telegram channels also intensify the publication of posts aligned with the regional policies of the Islamic Republic during specific periods, particularly when the regime is involved in a regional crisis.
For example, after the assassination of Ismail Haniyeh, one of the leaders of Hamas, these channels began to coordinate the dissemination of content supporting the Islamic Republic’s policies towards Israel.
The Telegram channel “Maktabkhaneh” published a report on August 1, 2024, under the title “Global News: The End of Israel,” claiming that the Islamic Republic had carried out a nuclear attack on Israel.
In this post, it states: “Israel has been attacked by ballistic missiles equipped with nuclear warheads from Iran and has been wiped off the global map and the face of the Earth.”
The annihilation of Israel is a promise that Ayatollah Khamenei, the Supreme Leader of the Islamic Republic, has repeatedly made.
The two Telegram channels “Maktabkhaneh” and “Tavileh Khodadoust” published more than seventy posts with “anti-Israel” content, calling for the “necessity of an Iranian attack on Israel,” and similar topics, within just five days after the assassination of Haniyeh. During this specific period, fifty-seven percent of the content on these channels was suddenly dedicated to this subject.
Additionally, in the days following Haniyeh’s assassination, the Telegram channel “Tavileh Khodadoust” published a post with the content “The certainty of the Wa’d al-Sadiq 2 attack” or quoted BBC, falsely claiming that “Iran’s attack is certain,” although no such news was released by BBC Persian.
Wa’d al-Sadiq (The True Promise) is the name of a military operation during which, in April 2022, Iran launched dozens of missiles and drones towards Israel.
These channels simultaneously and regularly publish content in support of Ali Khamenei, the Supreme Leader of the Islamic Republic, or other figures of the regime, including Qassem Soleimani, the former commander of the Quds Force. For example, on July 16, 2024, the “Maktabkhaneh” channel posted two images of the Supreme Leader of the Islamic Republic along with praise for him.
The Telegram channel “Maktabkhaneh” periodically posts various images of the Supreme Leader of the Islamic Republic, accompanied by the recurring caption, “It feels like we’re the leader ourselves…”. This same Telegram channel also posted images of “Ghasem Soleimani” or “Iran’s alleged missiles” interspersed with sexual content in June of this year.
Amidst the sexual and violent material, these Telegram channels also share audio files of speeches from religious figures closely tied to the Islamic Republic. For example, on August 26, 2024, the channel “Tavileh” posted a speech by Alireza Panahian titled “What Can We Do to Bring the Imam Mahdi?”
Alireza Panahian is a Shia cleric and a prominent religious speaker within the regime. He has held various cultural positions, including membership on the Board of Trustees at the University of Art, Deputy of Cultural Affairs for the Supreme Leader of the Islamic Republic at universities, Deputy of Cultural Affairs at the Islamic World Science Center, and head of the Supreme Leader’s think tank at universities.
Another piece of evidence indicating the political and religious alignment of these channels can be found in the “Tavileh Khodadoust” account on the social media platform X (formerly Twitter).
This account is linked to the “Tavileh Khodadoust” Telegram channel, and its first post demonstrates the account holder’s alignment with the policies of the Islamic Republic.
In its first post, this account wrote: “The Tavileh Khodadoust Twitter account has been launched in the hope of confronting the enemies of the sacred system of the Islamic Republic and those who seek to promote debauchery among girls.”
Attacks on Protesters and Opponents of the Islamic Republic
The administrators of these Telegram channels simultaneously use the platform to publish content against those who lost their lives in the protests of fall and winter 2022, known as the Jina Movement or “Woman, Life, Freedom.”
For instance, the “Maktabkhaneh” channel posted an image of the desecration of Mahsa Zhina Amini’s grave and claimed, “I broke the glass on Mahsa Amini’s grave.”
In May 2024, the “Tavileh Khodadoust” channel also requested its followers to urinate on the images of Mahsa Amini, Nika Shakarami, and Armita Geravand, victims of the “Woman, Life, Freedom” protests and the mandatory hijab in Iran, in exchange for money.
In another post, the same “Tavileh Khodadoust” Telegram channel requested nude images of Nika Shakarami, one of the victims of the “Woman, Life, Freedom” protests, in exchange for money.
The administrators of these channels have repeatedly mocked imprisoned protesters and welcomed the inhumane punishment of “execution.” In August 2024, the “Tavileh Khodadoust” Telegram channel, coinciding with extremists calling for the execution of Shervin Hajipour, a dissenting artist, posted: “Shervin has gone to join Toomaj. God willing, next year around this time, we’ll celebrate their executions.”
Shervin Hajipour, a singer, songwriter, and composer, received the 2023 Grammy Award for his song “Baraye,” which became one of the symbols of the “Woman, Life, Freedom” protests.
The “Maktabkhaneh” Telegram channel also reposted news regarding the “presence of Iranian queers at the Vancouver Pride Parade with the slogan Woman, Life, Freedom” with the caption: “99% of Pahlavi’s supporters abroad are from the same filthy-born crowd.”
Additionally, affiliation with Israel is one of the common accusations that the Islamic Republic attributes to many of its opponents as a means of suppression.
Ninja Bomber App: Using Technology for Harassment
Another function of these Telegram channels is organizing coordinated attacks against well-known political and civil activists. These channels typically share the private information of the targeted individuals, such as their phone numbers or other personal details, and ask channel members to intimidate them through phone calls or text messages.
One of the earliest instances of these coordinated attacks targeted Hossein Ronaghi, a political activist and former political prisoner. This assault prompted him to protest. Ronaghi has been repeatedly arrested and imprisoned by the Islamic Republic for his activism.
In May 2024, the “Maktabkhaneh” Telegram channel published Hossein Ronaghi’s phone number and asked its members to harass and threaten him. A similar case occurred in the “Tavileh Khodadoust” Telegram channel. The administrator(s) of this channel shared Ronaghi’s and his mother’s phone numbers, along with an Android or desktop application called Bomber, essentially arming their audience with a tool to send mass text messages and make numerous harassing phone calls to their target.
This Bomber app appears to be a paid service, and the Telegram channel itself has more than 24,000 members. This Telegram channel produces these apps for the mass sending of SMS messages.
Our Digital Security Helpdesk team’s technical analysis shows that Ninja bomber_1.8.apk, which was shared in the “Tavileh Khodadoust” channel as a tool to harass Ronaghi, is the same application that the “Ninja Bomber” channel claims to have developed and has published on its own channel.
However, we were unable to identify an organized and systematic connection between these two channels.
Hossein Shanbehzadeh, a political prisoner, was another target of these channels. The “Tavileh Khodadoust” Telegram channel published his home phone number, national ID number, address, postal code, as well as his mobile phone number and Telegram ID, and called on its members to attack him.
The “Maktabkhaneh” Telegram channel also published the information of an online shop, under the pretext of selling “anti-revolutionary t-shirts,” and invited its audience to attack the shop.
These attacks are, of course, not limited to political activists. The administrators of these Telegram channels apply the same approach of organizing group attacks on political activists to target other citizens by publicly sharing their personal information. Private photos, likely obtained through hacking a device or by exploiting trust, are widely shared. In such cases, channel members are encouraged to attack the victims, who are mostly women or young girls.
In one instance, the “Maktabkhaneh” Telegram channel shared the Instagram and Telegram IDs, as well as the mobile number of an individual, asking its audience to “Send an SMS telling them to die, give them a call, let’s scare them a bit and have a laugh.”
In another instance, the “Maktabkhaneh” Telegram channel published the mobile phone numbers of individuals solely because they had blocked them.
In a separate case, the personal information of the mother of an individual with whom they had a conflict, including her address, landline, mobile phone number, and even her national ID number, was also published.
Some of the information disclosed by the administrators of these channels may be found with minimal searching on social media. However, the publication of individuals’ identity documents requires access to specific sources and is not feasible for ordinary social media users.
Violation of Civil Rights in All Areas
Beyond political content, the primary function of these Telegram channels is the dissemination of sexual content, including pedophilia, rape, extreme violence against individuals and animals, and other illegal sexual material.
The “Tavileh” Telegram channel has shared links to videos with content such as “fried human,” “torture,” “crushed skull and exposed brain,” “cutting bones with a saw – human barbecue,” and other similar videos.
The “Maktabkhaneh” Telegram channel has also published a link to a video titled “Domestic Rape.”
The same Telegram channel has published information about a fourteen-year-old child, including the father’s name, address, and the child’s Telegram ID, along with a link to their nude images.
The administrators of these channels use various methods to create a safe margin and prevent the removal of sexual or violent content by Telegram.
One such method includes placing links to sexual content in the first comment of a post.
For example, the “Tavileh” Telegram channel directs its audience to the first comment of a post containing pornographic content in order to evade Telegram’s content moderation system or, at most, ensure that only a Telegram ID is removed rather than the entire channel.
Clicking on the link provided leads users to a Telegram bot.
These Telegram bots generally force users to join several other channels within the network.
The Telegram bot related to one of the pornographic posts for children shared in the “Maktabkhaneh” Telegram channel, for example, forces users to join three other Telegram channels within the same network.
Further investigations show that some of these Telegram channels have different content and functions but advertise to recruit members for one of the network’s channels.
For example, the “Omar Khayyam” Telegram channel directs its audience to a movie recommendation channel, a shoe sales channel, and a channel with sexual and violent content called “Fantezito Bego.” (Say your Fantasy.)
The “Fantezito Bego” (Say your Fantasy.) Telegram channel is the only channel in this network that contains only text, with no links, images, or videos, and has remained undetected by Telegram’s filters for an extended period, accumulating over one million followers.
Membership in these bots is mandatory for the audience of these Telegram channels. The “Tavileh Khodadoust” channel wrote in this regard: “Mandatory bot membership isn’t up to us. It’s the bot sponsor’s requirement.”
After “mandatory membership” in the channels suggested by the bot, images or videos containing violations or child pornography and similar content are displayed for a short period, usually less than 30 seconds, and then deleted.
The automatic deletion of images after a short period is another method these channels use to avoid the removal of sexual content by Telegram.
For example, in the “Omar Khayyam” Telegram channel, two posts containing private images of individuals were deleted in less than 20 seconds.
Network Functionality
These Telegram channels operate as a network, with each one inviting its audience to join other channels.
The “Tavileh” channel, in this way, gathers an audience for the “Tavileh Khodadoust” Telegram channel.
The “Omar Khayyam” Telegram channel has similarly asked its audience to follow the “Tavileh Khodadoust” channel.
The “Tavileh Khodadoust” channel also invites users to follow the “Maktabkhaneh” Telegram channel.
This approach ensures that after one channel is shut down and a replacement channel is created, it can quickly regain its audience through the administrators of other channels. For example, the “Maktabkhaneh” channel reached the threshold of 3,500 followers just five days after it was shut down and reopened.
Judicial and Security Safe Haven
In May of this year, these Telegram channels drew renewed attention when a conversation from one of the channels, discussing child abuse and methods of rape and assault against children, was shared on Twitter.
Following the release of this image, a group of civil activists, including several journalists and a lawyer, announced that they would follow up on the case and publish the results.
However, the promised report was not published in any newspaper for a long time, until August 24th, when Farhikhtegan newspaper finally published a short report on these Telegram channels. After the publication of this report, the author and one of the children in their family were targeted and threatened by the administrators of these Telegram channels. It then became clear that other journalists had previously been threatened and told not to publish anything on this topic.
At the same time, the “Maktabkhaneh” Telegram channel posted an image of a notice from the Cyber Police (FATA), stating that the law enforcement agency “bears no responsibility for filtered programs.”
The judiciary, even after several months, has neither addressed the case prepared by a group of human rights lawyers in Iran nor the complaint from the Farheekhtegan newspaper journalist.
This is in stark contrast to how the Islamic Republic’s security organizations and the judiciary typically act swiftly to arrest the administrators and owners of Telegram channels that publish political content or content outside the standards of the Islamic Republic. Numerous political and civil activists have been arrested solely for posting content opposing the policies of the Islamic Republic. Additionally, business owners who post images without the mandatory hijab are also detained by security agencies. However, the administrators of these Telegram channels have continued to operate under protection, publishing sexual, gender-based, and violent content, while simultaneously promoting the policies of the Islamic Republic.
Appendices
Hash | Description | App Name | # |
| 480345570086efd73f170e36b5a210ee | The original version of the app found on the Ninja channel | Ninja bomber_1.8.apk | 1 |
| 480345570086efd73f170e36b5a210ee | A version of the app found on the “Tavileh Khodadoust” channel | Ninja bomber_1.8.apk | 2 |
| cf8e63590eb1d87eb94daf9f0d1fd958 | The latest version of the app released on the Ninja channel up until the time of this report’s publication | NinjaBomber_1.9.apk | 3 |
https://t.me/TavileKhodadostNew
https://t.me/tavilekhodadostguard
