A US creator, a Tehran operation, a state that pays
The person who put a named American under a bullseye is identifiable, is on the record claiming the work, and openly partners with an operation the Iranian government pays. Here is the whole finding before I show how each piece is established.
- The creator is identified. The persona that made and published "Bullseye Loomer" is operated by Mahdi Mohammad Hemmat, a US person and critical-care nurse in Milwaukee, Wisconsin, who claims authorship of the videos on camera. Proven · High
- He is tied directly to the threatening content. "Bullseye Loomer" is one entry in a serial named-target series he published, which also targeted Lindsey Graham, Ben Shapiro, the President and others. Proven · High
- He openly collaborates with an Iran-based operation. He co-authors posts and publicly brands a joint "LEGO Resistance Front" with Explosive Media (formerly "Akhbar Enfejari"), a Tehran animation company. Proven · High
- That operation is tied to the Iranian government. Its operator told the BBC the government is a paying customer that directly commissioned work; IRGC-affiliated Tasnim and Iranian diplomats amplify it. Formal IRGC command is assessed, not proven. Probable · Moderate
- Iranian and Russian state media platformed him by name. Iran's official IRNA co-published an interview; IRGC-affiliated Fars profiled him; Russia's RT and France 24 interviewed him and RT reposts the material. Proven · High
- The threat is current and escalating. Five days before this report, the collaborating operation placed Loomer on an on-screen "revenge" enemies list alongside the President and others. Proven · High
- US jurisdiction applies, and the command question stays open. Because the creator is a US person, domestic legal process is available. Direct IRGC tasking of Hemmat himself rests on no direct evidence and is left as an open question, neither asserted nor excluded. Open
The finding rests on five directly verified judgments. The state-support link is graded Probable; only direct IRGC command of the subject stays Open.
A single hostile video is a nuisance. A serial named-target series, produced in a documented partnership with a state-commissioned foreign operation and amplified by that state's media apparatus, aimed at US persons, is a protective-intelligence problem, and because the creator is domestic, one the legal process can actually reach.
Subject, operation, state, amplifiers
Five layers, top to bottom: the foreign media that carry it, the Iranian state and IRGC nexus, the Tehran operation, the US subject, and the threatening content he produces. The strongest links are the ones nearest the middle.
Green/gold layers are directly verified (co-authorship, the BBC "customer" admission, on-camera authorship). The state-command link between the operation and a specific IRGC unit is the one rung graded open. The rest of this report establishes each layer in turn.
Not anonymous: a real, named US person
Two independent things fix the identity: a corroborated identifier chain tying the persona handles to the name Mahdi Hemmat, and his own on-camera statement to Russian state television that he makes "these Lego videos." Operator self-admission plus records is the strongest available basis for attribution.
Mahdi Mohammad Hemmat
- Critical-care transport nurse (neonatal/pediatric, CCRN); prior flight nurse in Hawaii. Identifies publicly as Iranian-American.
- Operates a large multi-platform "Lego Journalist" / "PersiaBoi" persona of pro-Iran, anti-war content branded "Sacred Defense."
- Public professional profile at linkedin.com/in/mahdihemmat documents a 13-year nursing career across WI, HI, MO, CA and VA.
- Also runs a YouTube channel and a Spotify artist page (~7,430 monthly listeners) releasing war-themed tracks.
His Wisconsin RN license (191416-30) expired February 28, 2026 and reads "not eligible to practice" as of a July 14, 2026 lookup, with no disciplinary orders on file, even though his profile lists current hospital employment. The lapse coincides with the period the Lego operation scaled up.
Where he publishes, and how far it reaches
This is not a fringe account. The persona runs across every major platform, and individual posts reach hundreds of thousands to over a million plays, which is what makes the named-target content consequential.
Follower and listener counts are platform-reported floors reviewed to July 14, 2026. Bars scale each platform's standing audience; the peak-post figure is a single-post reach floor, not an audience.
Digital footprint and identifiers
The persona resolves to him through a tightly corroborated chain (payment, professional, caller-identification, email and device records). The operational selectors compiled for referral are shown below with the sensitive values redacted: enough to show the resolution is real, not enough to be misused.
He did not comment on the targets. He made the target content.
"Bullseye Loomer" is one entry in a sequence that named one US figure after another, each published to a large audience. The threat characterization is measured: I describe the pattern; I do not assert imminence or capability, which open sources do not establish.
Reach figures are floors from platform-reported counts; the "Bullseye Loomer" joint post drew ~13.3K likes on Instagram before the target amplified it. Links: Bullseye Loomer (IG) · TikTok · Graham "War Hawk Down" · Graham "Who's next?".
The named-target content: Loomer under a crosshair in a series that celebrates "the fate of warmongers." · view on IG ↗
"Loomer Unleashed," part of the serial named-target output aimed at the client. · view on IG ↗
A named, identifiable US person is placed under a bullseye inside a series that celebrates a target's death as "the fate of warmongers" and asks "who's next." The operators are aware of the reading, posting "I don't know why some get scared and tag the FBI." I characterize the pattern; I do not assert imminence or capability, which open sources do not establish.
Not inferred from style. Declared and co-published.
The tie between Hemmat and the Iran-based operation is not a stylistic guess. It is announced on both operators' own accounts and repeatedly co-published through Instagram's co-author feature.
The co-authored "LEGO Resistance Front" declaration: "United with the LEGO Resistance Front … support Explosive Media & Persiaboi." · view on IG ↗
The Instagram "Collaborators" list on the Graham "Who's next?" post names both explosivemediaa and persiaboihemmat (Mahdi Hemmat). · view on IG ↗
Six co-authored posts in eight weeks
Cross-referencing both feeds, the two published at least six Instagram posts as formal co-author posts between May 16 and July 13, 2026, each appearing on both accounts. This is a sustained production partnership, not a single announcement.
| Date | Co-authored post | What it is |
|---|---|---|
| May 16 | "PersiaBoi × Explosive Media · United with the LEGO Resistance Front" | Alliance declaration |
| Jul 6 | "Rulers must be ashamed" | Joint content |
| Jul 7 | "Cheated and Defeated" | Joint content |
| Jul 12 | Lindsey Graham · "Who's next?" | Named target |
| Jul 13 | "Bullseye Loomer" | Named target · the client |
| Jul 13 | "Take it easy Larry" | Joint content |
Every row above is published to both accounts through Instagram's co-author feature, and their co-authored posts alone reach into the millions of plays. Hemmat's Facebook post of the same content is publicly tagged "with Akhbar Enfejari," Explosive Media's former name, whose profile lists Tehran, Iran. Proven
An organized Tehran production team, not a lone account
Explosive Media (formerly "Akhbar Enfejari," Persian for "Explosive News") is an Iran-based animation operation that produces English-language pro-Iran content and presents an on-camera team.
"Iranian Lego-style animation team … Lego Resistance Front #LRF."
Primary Instagram; backup account @explosivemediaa_backup.
Multi-platform distribution; admin @EXPLOSIVEAdmin.
A Tehran individual associated with the operation via an Instagram identity. Concerns a person separate from Mr. Hemmat; the two are distinct individuals in a documented collaboration.
Publicly posted wallets soliciting donations from a sanctioned jurisdiction.
The Iran operator identity is carried forward from prior ShadowGraph Intelligence work at the confidence that work supports (companion assessment: SGI-2026-CIB-002 / ATT-003). The operation presents multiple on-camera members in its promotional footage; only the "M.T.A.M" identity is named in prior work, and the remaining faces are unattributed and are not identified here.
How strong is each link to the Iranian state?
The tie between the Iran-based operation and the Iranian state runs from the operator's own admission, through diplomatic amplification, to reposting by IRGC-affiliated media. I grade each link by evidentiary strength. The state nexus is strongly documented; direct IRGC command of the operation is not, and is marked open.
BBC: the operator "admits the Iranian government is indeed a 'customer' … directly commissioned for multiple projects by Iranian officials." · overview & source ↗
Taken together, these indicators make it very likely the Iran-based operation is Iranian state-linked and state-supported: a company that admits the government commissions it, is amplified by IRGC-affiliated media and Iranian diplomats, and raises funds inside Iran. A specific IRGC unit, a tasking order, or Hemmat-specific direction is not established in open sources and would require authorized process to confirm. I state the strong nexus and mark the command question open.
Iranian and Russian state media engaged him by name
Beyond amplifying the network's content, state media apparatuses interviewed, profiled and co-published with the subject himself. This is the state's media engaging the person, not only his output.
Published a co-authored Instagram interview post with @persiaboihemmat and an IRNA journalist, plus a companion irna.ir article (May 2026) profiling him as an "Iranian-American animator." Proven
Profiled and quoted the subject by name across multiple pieces, presenting his Lego videos as "resistance" media. Proven
Interviewed him as the "Iranian Lego cartoonist" and reposts the material; a repost reportedly drew ~850,000 views. Proven
Interviewed him as the "Iran LEGO video creator," framing the work as "blurring the line between entertainment and propaganda." Proven
@RyanRozbiani (primary English-language bridge), @FurkanGozukara, and alternative-media figures @MaxBlumenthal, @georgegalloway, @KimDotcom carry it westward.
IRNA ("Iran state-controlled media") co-authored interview with @persiaboihemmat. · view ↗
Fars News (IRGC-affiliated) profiling the subject by name as a producer of the "resistance" animations. · view ↗
State media interviewing, profiling and co-publishing with the subject is directly evidenced and is a strong indicator that the Iranian state's media apparatus embraces him. It is distinct from, and not by itself proof of, IRGC command or tasking of the subject, which remains an open question. Named amplifiers are illustrative floors: reporting cited by open sources put pro-Iran network reach above a billion views in the first month of the conflict, so the true amplification set is far larger than what is captured here.
Grievance, to named targets, to a bullseye, to mass reach
The threat hardened in stages, then jumped from a niche audience to the mainstream when the target reacted and national press covered it. Each stage raises the stakes; the last borrows the target's own audience to reach the mainstream.
The ladder in one line: grievance → named targets → death celebrated → a bullseye on Loomer → mass amplification. The move to the mainstream borrowed the target's own audience. The dated record is below.
Russian state TV interviews Hemmat
RT presents him as the "Iranian Lego cartoonist," and he claims authorship on camera.
Public "PersiaBoi x Explosive Media" declaration
The co-authored "LEGO Resistance Front" announcement brands the joint operation.
A "revenge" board naming Loomer (94K views)
Explosive Media teases a "KT" music video with a "Chain of Crimes" board and a named enemies list including Laura Loomer.
"War Hawk Down. First on the list."
Named-target escalation on Lindsey Graham, and a co-post celebrating his death: "Who's next?" (404K plays).
"Bullseye Loomer" published as a joint post
Loomer placed under a bullseye, co-authored by persiaboihemmat and explosivemediaa.
The target amplifies; national press follows
Loomer amplifies it (~457K views), asks "How is this allowed?" and tags the FBI Director; national reporting follows.
On X, the "the IRGC is trying to kill me" framing traveled faster than the caveat that no public evidence ties the video to the IRGC as an institution. Both can be true at once: the content is real and the creator is documented, while formal state authorship of the specific video is unproven. This report keeps the documented propagation separate from that open question rather than collapsing them.
Confirmed on a July 14, 2026 review of the subject's live feed (~71,856 followers): the operation repeatedly produces content celebrating, insinuating or questioning the death, illness or "silencing" of prominent Americans it opposes, including Senator Graham ("War Hawk Down"), Senator McConnell ("Flatline Turtle," during his hospitalization) and Charlie Kirk ("silenced … who benefited the moment that voice went silent"). These are the network's own framings, not evidence of any involvement in those events, and SGI makes no such claim. The pattern is recorded because a group that habitually casts its named adversaries as marked for death, and whose current named list includes the client, warrants serious attention.
Five days before this report, a fresh "revenge" list
On July 9, 2026, the operation the subject openly collaborates with published new named-target content placing the client on an on-screen enemies list, then tagged the targets by handle to notify them.
The July 9 "KT" teaser: a "Chain of Crimes" board with "Revenge / We Are Revenge" placards and crosshair markers, naming Laura Loomer among the targets (~94K views). · view on IG ↗
The teaser is captioned to make the President "furious. And terrified," built around a "Chain of Crimes" conspiracy board carrying "Revenge" and "We Are Revenge" placards and crosshair markers, with the tagline "Every crime has a chain. Every chain has a name." The written list names eight public figures:
A companion post the same day directly tagged the targets by handle, including @LauraLoomer, captioned "Everyone loves seeing themselves in LEGO animations. How about you?", notifying each figure of their place on the list. Proven
Senator Lindsey Graham, a named target in the network's earlier content, died on July 12, 2026, three days after this post; preliminary medical reporting attributes his death to an aortic dissection, a natural medical cause. SGI asserts no connection. There is no evidence linking the network, the subject, or the Iranian state to Senator Graham's death, and the reported cause is a medical event, not foul play. The timing is recorded only because it has understandably heightened the concern of the living named targets, including the client, and it underscores why an ongoing, named-target threat stream should be taken seriously rather than dismissed. This is context, not a causal claim.
Verified from the public record, and caveated
Reported context for a threat assessment, not a finding of guilt. An arrest is not a conviction.
Hawaii coverage, Oct/Nov 2017: "Puna man arrested," naming Mahdi Hemmat, 28, released pending investigation. · view ↗
In October 2017 a "Mahdi Hemmat, 28, of Puna" was arrested on suspicion of second-degree attempted murder after his housemate and partner, Nicholas J. Theiss, was shot in the head; Theiss died on Nov 6, 2017. Police said the shooting was possibly accidental, that Hemmat called 911, and a rifle was recovered; Hemmat was released pending investigation.
No charging outcome appears in the public record, and a commercial background search returned no criminal record, consistent with release without charges. Hemmat's own public posts name Theiss as his partner, which ties him to the incident. The 2017 identification is Probable on name, town, photograph and the subject's own naming of the decedent as his partner; confirmation requires law-enforcement records. Probable
Civil record (all civil, not criminal): a 2019 St. Louis debt-collection suit (defendant), a 2023 Dallas motor-vehicle-accident suit (defendant), and a 2025 Honolulu owners-association dispute the subject filed (plaintiff, D. Haw. 1:25-cv-00532). Common-name caveat applies; confirmation is by docket pull.
Competing explanations, ranked against the evidence
I lay out the plausible readings of the operation's nature and rank them against the most specific evidence, rather than assuming the most alarming one.
A US-based diaspora creator (Hemmat) voluntarily collaborating with a state-commissioned Iranian company, self-motivated, without personal state tasking. Fits the documented co-authorship and the on-camera authorship without requiring unproven command.
A directed state operation in which Hemmat or the Iran operator acts under IRGC or Iranian-state tasking or funding. Consistent with the strong state nexus but unsupported by direct evidence of command; the open question.
Inflammatory content run for reach and crypto revenue. Not exclusive of H1; the crypto solicitation and viral framing are consistent with a monetization layer alongside the ideological one.
ShadowGraph Intelligence asserts no offense has been committed; it frames questions and the factual basis for pursuing them. A domestic subject means domestic legal process is available to the platforms and services holding the records identified here; content placing named persons under bullseyes may warrant evaluation under federal provisions on interstate threats and threats against certain officials, with thresholds for prosecutors. Charging decisions belong to prosecutors and the Bureau.
The evidentiary line
The creator, the collaboration and the state media engagement are proven; the chain of state command over the subject is not. I keep those apart.
What I can show
- A named US person created and published "Bullseye Loomer" and a serial named-target series, and claims the videos on camera.
- An open, co-authored collaboration with a Tehran operation, declared as the "LEGO Resistance Front."
- The operation's operator told the BBC the Iranian government is a paying "customer" that commissioned work.
- Iranian (IRNA, Fars) and Russian (RT) and French (France 24) media engaged the subject by name.
- A current, escalating, named-target stream that includes the client.
What I do NOT claim
- That Mr. Hemmat acts under formal Iranian-state or IRGC direction; state control of him specifically is an open question.
- That the IRGC as an institution produced or ordered the Loomer video.
- That Mr. Hemmat committed any offense in 2017; I report only the public record and note release without charges.
- That Laura Loomer's own audience is inauthentic; that audience reads as organic.
- Any connection between the network and Senator Graham's natural-cause death.
The takeaway
A video that put a named American under crosshairs was not the work of an anonymous account overseas. It was created and published by a United States person, a Milwaukee critical-care nurse who claims the work on camera, in open and repeatedly co-authored collaboration with a Tehran animation operation the Iranian government pays as a "customer," and it was carried by Iranian and Russian state media that engaged him by name. The collaboration is proven, the state nexus is strongly documented, and the threat is current: five days before this report the same operation placed the client on a fresh "revenge" enemies list. What I do not claim is direct IRGC command of the subject, which no public evidence establishes and which only authorized process could resolve. I grade the collaboration and the amplification as proven, mark the command question open, and keep the two apart.
Because the creator is domestic, the next step is one the legal process can actually take: preservation of the videos, posts, co-authorship metadata and interview clips, and legal process to the platforms and providers to confirm the registration and content records behind the identifier chain laid out here.
I am Travis Hawley. If you are being named, targeted, or amplified by an operation like this one, or you want a threat stream traced and attributed, find me at shadowgraphintel.com/contact, @talk2trav on X, and @talk2trav on Instagram. And scrutinize whatever you read next, including me.
How this was done, and where I stopped
The disciplined version of everything above, for the reader who wants to stress-test it.
This is an evidence-led open-source assessment of who produced a specific body of named-target content and how it connects to an Iran-based operation and the Iranian state. It is not a legal finding and reaches no conclusion of guilt. I grade every claim by strength and keep what is directly verified (on-camera authorship, co-authorship metadata, the BBC "customer" admission, state-media co-publication) apart from what is strong-but-inferential (state support of the operation) and what is open (formal IRGC command of the subject). I do not adjudicate the underlying dispute over the war with Iran. I make no allegation that Laura Loomer's audience is inauthentic, and I assert no connection to Senator Graham's natural-cause death.
Identity rests on a corroborated identifier chain (payment, professional, caller-identification, email and device records) cross-checked against the platforms' public displays, plus the subject's own on-camera statements. Collaboration and content findings rest on both operators' public posts and Instagram's co-author metadata. State-nexus and amplification findings rest on open-press reporting (BBC, WIRED, an international broadcaster, Hawaii outlets), each linked. Prior ShadowGraph Intelligence work on the Iran-based operation is carried forward at the confidence that work supports. Collection was passive and lawful: no account was accessed, no login or password reset, no verification code requested or entered; masked identifiers were read from commercial records and platform-displayed hints only.
Every reach figure here is a floor, not a census: video and caption-only capture undercount, and platform counts should be re-verified at publication. "Mahdi Hemmat" is a common name; namesake accounts were separated out, and the subject chain rests on shared identifiers, not the name alone. The 2017 identification is Probable on name, town, photograph and the subject's own naming of the decedent; confirmation requires law-enforcement records. State direction of the operation is assessed as very likely; personal state tasking of Hemmat is unproven, and absence of open evidence is a collection boundary, not proof of absence.
Evidence-based assessment of publicly observable data, correlations and patterns. Certain claims remain unverified and this is not a determination of wrongdoing. Companion work on the Iran-based operation: SGI-2026-CIB-002.