A groundbreaking digital forensics investigation has uncovered the clandestine operational infrastructure of Canary Mission, an anonymous doxxing platform with ties to Israel that has been utilized to target pro-Palestine advocates in the United States. The probe, conducted by Drop Site News throughout 2025, exposed multiple concealed websites and content management systems employed by the shadow organization.
Forensic analysts working over a three-month period recovered extensive internal documentation including strategic planning materials, internal communications regarding meetings and quarterly objectives, employee identities, contractor information, and assessments of the group’s political influence. The findings, published this week, provide unprecedented visibility into the mechanics of this controversial operation.
One discovered platform, BlackNest, functioned as an unlisted dashboard celebrating the deportation and professional dismissal of pro-Palestine academics and students as measurable achievements. This internal system categorized the organization’s impact on suppressing criticism of Israel within US policy frameworks through multiple metrics: behavioral modification, employment termination, US entry denials, arrests, and forced deportations.
According to the investigation, BlackNest operated a daily updated interface featuring infographics and media compilations designed to demonstrate the platform’s policy influence. This included documentation of an NBC report revealing that Department of Homeland Security officials testified in court proceedings that ‘most’ deportation targets for pro-Palestine activism were identified through Canary Mission’s database.
The core Canary Mission website maintains an extensive repository profiling students, professors, and organizations accused of expressing anti-Israel or antisemitic views. Their stated mission involves ‘documenting individuals and organizations that promote hatred of the USA, Israel and Jews on North American college campuses.’ Targeted groups include the Palestinian Youth Movement, Students for Justice in Palestine, and Jewish Voice for Peace.
The investigation revealed that over thirty operatives employ fabricated social media accounts to harvest personal information and monitor pro-Palestine individuals. Internal performance metrics highlighted specific achievements, including one staff member credited with ‘identifying an activist’ from viral online content and another praised for completing ‘Stanford Arrest Profiles.’
A recovered 21-page strategic document outlined the organization’s 2025 objectives, which included brand differentiation, data sharing with donors, operational scaling plans, and a weekly target of 150 new profiles. The document explicitly described ‘anonymity as a tool to scare the enemy’ and a ‘bottom-up approach: Using individuals to take down organizations.’
Technical evidence indicated the organization developed facial recognition software combined with data scraping to automatically identify persons of interest. Investigators also uncovered an attempted but largely abandoned project called Museum of Online Antisemitism (MOA), which included code designed to protect doxxers’ anonymity.
The digital trail led to an Israeli company called Shefing, based in a Jerusalem WeWork facility and owned by French-Israeli entrepreneur Philippe Cohen, which appears to have developed software for both Canary Mission and MOA.
This investigation builds upon previous reporting that attempted to trace the organization’s funding, which is deliberately obscured through complex financial channels. Previous investigations by The Forward magazine in 2018 revealed that a US Jewish charity designated $100,000 for ‘Canary Mission for Megamot Shalom,’ an Israeli charity with minimal digital presence. Evidence suggests Canary Mission is likely operated by Megamot Shalom, owned by British-born Israeli Jonathan Bash, with funding channeled through American nonprofit structures to Israeli entities.
Despite these findings, the individuals ultimately funding and directing this extensive doxxing operation remain largely concealed behind sophisticated digital and financial obfuscation techniques.