Israeli security services have launched an investigation into a threatening campaign targeting hundreds of Israeli academics and students worldwide, with officials pointing to likely Iranian state involvement based on established patterns of Tehran-backed operations.
The website, operating under the name “Punishment for Justice Movement,” published detailed personal information for Israeli researchers, scientists, professors and students at institutions including Ben-Gurion University, the Technion, Hebrew University, Harvard, Oxford, and CERN. The platform offered tiered financial rewards ranging from $1,000 for acts of intimidation to $100,000 for assassinations of 40 designated “special targets.”
Investigation Underway as Technical Indicators Reviewed
Israeli intelligence services including the Mossad, Shin Bet, and National Cyber Directorate are investigating the website and the personal information that was posted before the site was taken down. The exposed data included home addresses, phone numbers, email addresses, and images of Israeli passports and U.S. visas of “special targets.” Officials noted particular concern for academics’ vulnerability during international travel given images of passports and visas could facilitate tracking of targets abroad.
Security analysts note several technical characteristics suggesting state sponsorship. Domain registration records show privacy-protected domain registration in Drenthe, Netherlands in August 2025 through UltaHost. The group also used Cloudflare, a Western hosting provider, as its content delivery network, creating layers of obfuscation that complicate attribution efforts.
This is likely a strategic choice indicating awareness that Iranian-hosted infrastructure would limit Western audience reach and that rapid exposure was a priority. Initial linguistic analysis of the website’s content suggested it was written by a non-native English speaker and the operational methodology aligns with known Iranian threat actor characteristics.
“The use of a Western hosting company indicates that the group wanted maximum exposure to Western audiences,” according to analysis by the Foundation for Defense of Democracies’ Center on Cyber and Technology Innovation. “It also indicates that the group knew that the website would be taken down quickly once discovered and so prioritized high visibility in a short period of time.”
The Anti-Defamation League (ADL) questioned how infrastructure providers UltaHost and Cloudflare allowed the site to operate, calling on companies to implement safeguards preventing dangerous threats from emerging on their platforms.
The “justification” provided by the “Punishment for Justice Movement” group, that academics “use their knowledge to kill innocent people and children by spreading weapons of mass destruction to the Israeli military,” echoes rhetoric consistently employed in Iranian state media and proxy operations.
Potential U.S. Law Enforcement Jurisdiction
Because some of the targeted Israeli academics reside in the United States, federal law enforcement may have jurisdiction to investigate. Security experts are calling for FBI involvement, including:
- Requesting website registration data from UltaHost and Cloudflare to identify operators despite privacy protections
Domain information screenshot (Source: X @GnasherJew) - Coordinating with Dutch and international law enforcement partners to trace the Netherlands-based registration
- Investigating individuals who submitted contact forms through the platform
- Pursuing potential charges for harassment and attempted assault
- Analyzing linguistic patterns and metadata to establish operational origins
Academic Community Response
The Committee of University Presidents issued a strong condemnation, calling the campaign “a dangerous and horrifying escalation” that “marks academics and permits their blood.” The committee warned that “domestic incitement joins a wave of antisemitism and hostility from abroad, creates a toxic and deadly mix that could end in loss of life.”
Some targeted academics responded with defiance. University of Oxford computer science professor Michael Bronstein dismissed the threats as the work of “nutcases who have a lot of free time and no serious job.” while expressing mock offense at the bounty amount given his academic standing.
“I was profoundly disturbed and shocked that my head was valued so cheap – considering my standing in the academic community, I find anything below a seven-figure highly offensive,” said Bronstein. “I am, however, consoled that I am at least in good company.”
While the website has been shut down/removed, security officials emphasize that the widespread media coverage may have already achieved the operation’s primary objective of instilling fear among Israeli academics and researchers worldwide. Given the inclusion of U.S.-based academics among the targets, investigations by U.S. authorities to determine whether any individuals are attempting to act on the solicitations and provided information may be warranted to ensure the objectives of physical violence are not achieved as well.