July 30, 2026

Overview

As tensions between the United States and Iran continue to escalate, DarkOwl researchers have observed a marked increase in online threats targeting the life of President Donald Trump. These threats span multiple layers of the internet — from dark web onion sites and encrypted Telegram channels to mainstream Iranian state-aligned media — and reflect both grassroots extremist sentiment and coordinated state-adjacent messaging. This post details DarkOwl’s findings.

The Dark Web Fundraiser: “8647 Kill Donald Trump”

DarkOwl researchers identified an onion site operating under the name “8647 Kill Donald Trump”, claiming to have allegedly gathered over $300,000 USD and actively promoting a $1 million fundraising campaign. The site describes its operators as a team of “highly qualified professionals united by a single goal: to eliminate the threat and protect the world from those who create danger.”

The site is published in three languages — English, Arabic, and Chinese — suggesting an intent to reach a broad international audience. Two QR codes are displayed on the site: one linked to a Bitcoin (BTC) wallet address, and one to a Monero (XMR) wallet address, providing anonymous payment channels for potential donors.

The number “8647” embedded in the site name carries specific significance. Multiple sources report that Republicans have flagged the number as split into two parts — 86 and 47 — read as a call for the assassination of President Trump, the 47th president. In American slang, “86” means to remove or get rid of someone, making “8647” a thinly veiled reference to eliminating him.

IRGC-Aligned Channels Amplify the Campaign

DarkOwl researchers observed IRGC-associated Telegram channels actively promoting the hashtag “کشتن ترامپ” — translating directly to “Kill Trump” — across multiple platforms.

Sabereen News, a pro-Iranian Telegram channel closely aligned with Iran’s “Axis of Resistance” narrative and considered to have close ties to the IRGC, posted on March 19th, 2026, that the offer for killing President Trump was being raised to $100 million USD, sharing a clearnet website alongside the announcement.

The same campaign was subsequently amplified by two additional IRGC-tied channels — the IRGC Quds Force News Channel and another pro-regime outlet — with posts published on March 21st and March 23rd, 2026, respectively.

KillTrump.info: Iranian Infrastructure

Researchers identified a domain — killtrump.info — that was promoted across these channels. While the domain is no longer online at the time of writing, WHOIS records reveal it was registered through an Iranian hosting company, Netmihan Communication Company Ltd, a finding that points to Iranian infrastructure underpinning the campaign.

The campaign was seeded on Iranian domestic social media platforms Eitaa and Rubika — both widely used inside Iran — days before being promoted on the above-mentioned Telegram channels, suggesting a deliberate domestic-first promotion strategy. A further Eitaa post was also identified as part of the same seeding activity.

IRGC-Affiliated FarsNews Covers the Campaign

FarsNews — the pro-Iranian news agency directly and formally affiliated with the IRGC, widely described as the cornerstone of the IRGC’s disinformation and propaganda apparatus, and designated by the U.S. Treasury under Executive Order 13553 in September 2023 — published a report on March 17th, 2026 covering the emergence of the Kill Trump campaign and its $100 million USD reward, sharing the fundraising website used to collect donations for it.

The fact that an IRGC-affiliated news agency was covering — and effectively amplifying — the campaign underscores how far this narrative has been normalized within Iran’s information ecosystem.

Some members of the Iranian diaspora community also reported that Iranian citizens residing inside Iran were receiving unsolicited SMS messages promoting the Kill Trump fundraising campaign and calling on recipients to participate, as documented by IranWire on X.

Handala Hacking Group Enters the Picture

On March 24th, 2026, the Iranian news agency Mehr News reposted a statement from the Handala hacking group. In direct response to a $10 million USD bounty placed on Handala members by the U.S. Department of Justice, the group announced a $50 million USD reward for the killing of both President Donald Trump and Israeli Prime Minister Benjamin Netanyahu.

This $50 million USD reward for Trump and Netanyahu remains active on Handala’s most prominent domain as of the time of writing, with the original post dated March 24th, 2026.

Handala’s entry into this campaign is significant: it represents a named, organized threat actor with established cyber capabilities formally attaching itself to a targeted assassination bounty — and one that has directly responded to U.S. law enforcement pressure with an escalatory public threat.

KillTrump.me: The Campaign Continues

On March 31st, 2026, Sabereen News introduced yet another domain — killtrump[.]me — which was found to be hosted on an IP address based in Iran, again belonging to Netmihan Communication Company Ltd.

The same site was shared across Iranian websites on March 30th, 2026 — one day prior to the Telegram announcement — again suggesting pre-seeding on domestic platforms before broader promotion.

KillTrump.ir: A Country-Code Domain and Iranian Hosting

On April 5th, 2026, a further domain — killtrump[.]ir — was introduced and shared via a post in the Sabereen News channel on the Iranian social platform Eitaa. This domain uses Iran’s country-code top-level domain (.ir) and was not available at the time of writing.

The site was hosted on an Iranian IP address — 185.143.234.235 — belonging to subnet 185.143.232.0/22, AS 205585, operated by Noyan Abr Arvan Co. (Private Joint Stock), a major Iranian cloud infrastructure provider. The latest archived records of the domain suggest the title translates to English as “Kill Trump.”

A clear and deliberate pattern emerges across all these domains: the “KillTrump” brand remains consistent, with only the TLD rotating — .info, .me, .ir — suggesting an operational strategy to maintain the campaign’s online presence even as individual domains are taken down.

Claimed Donations and State-Media Validation

A report published by Iran International on March 25th, 2026 cited pro-Iranian regime media claiming that more than $25 million USD had been donated toward the Kill Trump campaign reward fund. While these figures cannot be independently verified by DarkOwl, their amplification by state-adjacent media lends the campaign a degree of institutional visibility that goes well beyond fringe activity.

Senior Regime Voices Echo the Sentiment

The campaign extends well beyond anonymous dark web actors and fringe Telegram channels into the highest levels of Iranian political commentary.

On June 28th, 2026, Hossein Shariatmadari (حسین شریعتمداری) — an Iranian journalist and political commentator best known as the editor-in-chief of the conservative newspaper Kayhan (کیهان), a representative of the Supreme Leader, and a hardliner with significant influence in Iranian decision-making — published an article addressing three points on negotiations with the United States. The final point read: “And finally, the effort and expense to take revenge on the murderer of our martyred Imam, in that very land of America” — widely read as a thinly veiled reference to retaliatory action against President Trump on U.S. soil.

On July 11th, 2026, Hamshahri Online — a major Persian-language national daily newspaper owned and operated by the Tehran Municipality — published a report citing Iran’s new Supreme Leader stating that revenge is “a definite demand of the nation,” and listing 13 named individuals including Donald Trump and Benjamin Netanyahu as targets.

On July 16th, 2026, the Islamic Resistance in Iraq (Arabic: المقاومة الإسلامية في العراق) — an Iran-backed umbrella coalition of Shia militant factions operating under the strategic direction of the IRGC Quds Force — promoted a $10 million USD reward for anyone who kills President Trump or provides assistance toward his assassination.

Legal Precedent: A Foiled Plot Already on Record

These findings do not exist in a vacuum. On March 6th, 2026, the U.S. Department of Justice announced the conviction of Asif Merchant, also known as Asif Raza Merchant — an Iranian intelligence agent found guilty of terrorism and murder-for-hire charges in connection with a foiled plot to assassinate U.S. politicians and government officials, including President Trump, on American soil. The conviction confirms that Iranian-linked assassination plotting against the U.S. president has already moved from online rhetoric to operational planning.

Assessment

The findings documented above reflect a multi-layered, persistent, and escalating campaign spanning anonymous dark web infrastructure, IRGC-affiliated Telegram channels, Iranian domestic social media platforms, state-adjacent and state-owned news agencies, named hacking groups, and senior regime voices. Several indicators are worth highlighting:

Iranian hosting infrastructure — specifically Netmihan Communication Company Ltd and Noyan Abr Arvan Co. — is used consistently across multiple killtrump domains, pointing to organizational coordination rather than spontaneous grassroots activity.

TLDs rotate deliberately as domains are taken down, an operational resilience that suggests continuity of intent and a structured effort to maintain the campaign’s online presence.

The Handala hacking group’s involvement adds a cyber threat dimension to what might otherwise appear to be a purely rhetorical campaign, particularly given its direct response to U.S. DOJ pressure with an escalatory $50 million bounty.

Content is pre-seeded on domestic Iranian platforms — namely Eitaa and Rubika — before international Telegram amplification, pointing to a structured dissemination strategy rather than organic spread.

Senior regime-aligned voices have amplified the campaign, including a representative of the Supreme Leader, a Tehran Municipality-owned newspaper, and the Iran-backed Islamic Resistance in Iraq, elevating the campaign from fringe extremism to something with demonstrable institutional backing.

---

DarkOwl will continue to monitor developments across dark web and open-source channels as the situation evolves. Stay up to date.