At least 1,719 people are reported to have died after two devastating earthquakes struck northwestern Venezuela last week.

The final casualty count is expected to rise significantly.

Some media outlets report resident’s growing frustration with the Venezuelan government and its recovery efforts.

Sky News on June 29 reported that the United Nations Coordinator for Humanitarian Affairs in Venezuela was preparing for as many as 10,000 deaths. 

Social media posts, news reports and drone footage have been shared in recent days, proving vital sources for many Venezuelans (both in the country and living abroad) who are searching for information about loved ones who remain missing.

Social media pages have been set up listing many of those who are yet to be accounted for. Others have contacted Bellingcat asking if apartment blocks relatives were staying in are still standing. 

Bellingcat has received satellite imagery from Planet Labs PBC that shows one the worst affected areas in the country, including collapsed buildings and apartment blocks in La Guaira.

Readers can move laterally and vertically to observe the full image in the interactive below as well as zoom in on specific areas to assess the damage. A share button on the top right will copy a shareable link to the zoomed in area.

Scroll and zoom to see damage throughout the affected Venezuelan coast. Toggle between English and Spanish. Share a link to a specific location by clicking the button on the top right. The before imagery is from Jul 30, 2025 and Dec 12, 2023. After imagery is from Jun 27, 2026. SkySat imagery via Planet Labs PBC.

The high resolution image covers a 14-mile stretch of Venezuela’s northern coast from the towns of Catia La Mar to Caraballeda, which have been among the worst impacted. 

Other areas to be significantly impacted but not included in the imagery above include Caracas, Maracay, Valencia, Barquisimeto and Yaracuy.

We have compared the satellite imagery we obtained with previous images captured before the earthquake to identify which parts of this 14-mile stretch of coastline to show changes since the quakes. 

Readers can toggle between the imagery captured on June 27 (five days after the Jun. 24 quakes) and a composite of reference images taken on Jul. 30, 2025 and Dec. 11, 2023 (before the quakes).

Zooming in on specific areas reveals the scale of the damage.

For example, several buildings seem to have been flattened in the below before and after images showing the Playa Grande area.

Before imagery (left) of Playa Grande is from Feb 27, 2026. Imagery from after the earthquake (right) is from Jun 26, 2026. SkySat imagery via Planet Labs PBC.

The Planet Labs imagery also confirms significant destruction in the town of Carabelleda.

Before imagery (left) of Carabelleda is from Jun. 19, 2026. Imagery from after the earthquake (right) is from Jun 27, 2026. SkySat imagery via Planet Labs PBC.

Another area, Macuto, has been significantly impacted as well.

Before imagery (left) of Macuto is from Mar 20, 2026. Imagery from after the earthquake (right) is from Jun 27, 2026. SkySat imagery via Planet Labs PBC.

Footage taken on the ground and posted to social media also displays the devastation.

A minute-long video filmed on a 500-meter section of José María España Avenue in Carabelleda shows as many as a dozen collapsed buildings, most of them high-rises. This drone footage gives an aerial look of the destruction of at least six apartment blocks in the same area.

Another video shared on social media showed a collapsed hotel in Macuto, between Carabelleda and La Guaira.

Other open source information about the damage in cities such as Caracas, Valencia and beyond can be found on this site where individuals are uploading images and videos detailing damage.

While international rescuers continue to arrive in Venezuela, the threat of aftershocks remains.

Reuters also reports that engineers fear many buildings that remain standing could be vulnerable and are requesting an audit of state housing.

---

Carlos Gonzales, Jake Godin and Miguel Ramalho contributed to this report.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

The post Satellite Imagery Shows Scale of Venezuela Earthquake Damage appeared first on bellingcat.

This article is the result of a collaboration with The Sunday Times. You can find their corresponding piece here.

Every Friday evening, the brochure says, players can compete to win cash prizes in one of the world’s fastest-growing racquet sports. The padel club in Dubai’s west is the picture of modern wellness culture: climate-controlled courts, a private sauna and ice bath, and one-on-one coaching. The promotional image shows a bearded man in mid-swing, eyes locked on the ball. He wears matching activewear and a golden tan. The poster boy for padel is a talented player who once finished runner-up at an international tournament. He has also spent the past decade living in the shadows.

Ian Thomas Dixon is a key figure in the Kinahan cartel, the Irish organised crime group that authorities say has evolved into a US$1.5 billion transnational network involved in drug trafficking, money laundering and arms smuggling. Investigators have connected the cartel to Iran’s intelligence services and the Lebanon-based militant group Hezbollah. Its feuds with rival gangs have been linked to at least 18 murders across four countries.

Dixon, 36, along with the Kinahan Organised Crime Group’s senior leadership – Christy Kinahan, 69, and his sons Daniel, 49, and Christopher Jr, 45 – was sanctioned by the US government in 2022. Authorities allege the Irishman acted as a trusted lieutenant to Daniel Kinahan, who is said to manage the cartel’s vast drug trafficking operation by helping move bulk cash across Europe, arranging payments and keeping tabs on money owed by a narco-trafficker.

Bellingcat and The Sunday Times can today reveal how Dixon’s racquet sport hobby has left behind a digital trail that led to the most recent footage of him since those sanctions were imposed – the first time he has been pictured publicly in almost a decade. This investigation also uncovers the alias Dixon has used in Dubai and exposes the first open source links to an underworld associate who was recently extradited from the Gulf state and jailed in Scotland.

It comes as cartel leader Daniel Kinahan awaits extradition to Ireland after his arrest in Dubai on foot of a warrant issued by Irish authorities. The arrest, in April, followed an extensive policing and diplomatic effort from international law enforcement.

In March, investigations by Bellingcat and The Sunday Times exposed the first photographs of Daniel Kinahan and his father in years and also revealed that the cartel’s “friend”, former UFC fighter Mounir Lazzez, was connected to US sanctions against Iran.

The latest findings give an unprecedented glimpse into the recent activity of a key cartel associate who, until now, has largely flown under the radar.

Family Ties

When cartel founder Christy Kinahan moved to Spain after his release from an Irish prison in 2001, it wasn’t long before his new home became a hub for the gang. His sons, Daniel and Christopher Jr, soon followed him to the Costa del Sol – as did their younger cousin, Dublin native Ian Dixon.

From the late 2000s onward, Dixon worked for businesses linked to the crime family in the south of Spain. One of these was The Auld Dubliner, a pub in Estepona that reportedly served as a base of operations for the cartel. In 2010, the pub was raided and temporarily closed by authorities as part of Operation Shovel, a years-long multi-national police investigation into the cartel’s drugs and arms-trafficking activities.

Dixon would also work as a trainer at MGM Marbella, the boxing gym co-founded by Daniel Kinahan that would go on to represent some of the biggest pro boxers in the world. The company, which was renamed MTK Global, shut down after the US sanctions on the Kinahans were imposed in April 2022.

In 2016, Dixon was arrested by Spanish police investigating the murder of Irish criminal Gary Hutch. The previous year, Hutch had been gunned down while out for a morning jog in a gated community on the Costa del Sol.

Dixon was released without charge, and another Kinahan cartel associate was later sentenced to 22 years for his role in the murder. The killing sparked a feud between the Kinahans and the rival Irish Hutch gang  that resulted in at least 18 deaths. 

Dixon and other key Kinahan members fled to Dubai in the wake of the deadly feud.

Ian Dixon has no known convictions. But his alleged role in the Kinahan Organised Crime Group was laid bare when the US sanctioned him. Authorities said Dixon managed finances and moved bulk currency for Daniel Kinahan and also kept tabs on the debt owed by a narco-trafficker. 

The sanctions notice also said Dixon controlled Hoopoe Sports LLC, a Dubai firm that listed a number of pro boxers among its clients and reportedly received more than $4 million for bouts involving former heavyweight champion Tyson Fury. Boxing promoter Bob Arum told Yahoo Sports the money was for consulting fees owed to Daniel Kinahan.

Dixon lived in an exclusive gated community in Dubai, according to the 2022 sanctions notice. Online listings show that properties like his Spanish-inspired villa are worth up to $2.7 million.

Passion for Padel

Padel is an increasingly popular racquet sport from Mexico best described as a combination of tennis and squash. According to the sport’s governing body, it has more than 17.5 million weekly players across 150 countries and the UAE, where Dixon lives, has the second-highest number of padel courts in Asia. It was on these courts in late 2024 that Dixon played in the master final of the Asia Pacific Padel Tour (APPT).

APPT rankings show Dixon registered for the tournament under the name “Ian Thomas”. Like his cartel leader relative Christy Kinahan, who used his first and middle names as an alias on his Google review profile, Dixon had dropped his surname.

Finding a Fugitive – How we Located Dixon

Bellingcat found the padel club promotion showing Ian Dixon after running images of the cartel associate through a publicly available facial recognition search engine. Among the results was a link to a graphic designer’s online portfolio, which included the advertisement for the padel competition. The original photo had been posted on the sports club’s Instagram page in late 2023, with the caption: “Elevating fun, one swing at a time!” Dixon was not named.

We searched for additional open source evidence and located online profiles for a 36-year-old Irish padel player named “Ian Thomas” who had taken part in a number of matches in Dubai in recent years. One profile shows he played 16 ranked matches between September 2024 and April 2026 – the most recent being the week after Daniel Kinahan’s arrest. But the accounts did not include profile pictures.

Bellingcat searched for footage showing the padel events and venues listed on the profiles. It returned multiple social media posts and live-streams clearly showing Ian Dixon at the same events where “Ian Thomas” was registered as playing. Dixon can also be heard speaking with a Dublin accent and at one point is seen with a close relative of Daniel Kinahan.

Dixon and his doubles partner played four games over the December 13-15 weekend, eventually placing second after losing in the final. The Irish cartel associate is captured on film after the match receiving a silver medal and commemorative racquet.

The Asia Pacific Padel Tour was held a month after senior Kinahan cartel figure Sean McGovern was arrested in Dubai on foot of an Interpol red notice. McGovern was extradited to Ireland last year and earlier this month jailed for 24 years for directing the activities of a criminal organisation in relation to murder and attempted murder. 

The tournament was live-streamed to YouTube via webcams set up on two courts. Dixon was captured throughout the three-day event, both playing on the court and mingling with others in the background. The hour-long male amateur final, which Dixon lost, is viewable in its entirety.

Dixon also posed for photos during the tournament, but it appears he did have some reticence about appearing on social media. In two images from a different padel event hosted at the same venue a few months later, Dixon’s face had been covered. However, a third photo was not edited, confirming that it was Ian Dixon.

Kingpin in the Crowd

Among the people Dixon was seen with at padel events in Dubai was Stephen Jamieson, a Scottish criminal who was recently jailed for his role in a multimillion-dollar drug trafficking operation.

Dixon greeted Jamieson with a fist pump during the Dubai APPT tournament in December 2024 on the day the Irishman played in the amateur final.

Dixon was also pictured with Jamieson at a family day padel event just weeks before the Scottish criminal’s arrest. (Bellingcat is not publishing details of that event to protect the identity of family members.)

Jamieson, who has multiple convictions, was extradited from Dubai last year and is serving a six-year prison sentence in Scotland on organised crime and drug charges. The case against him was built around intercepted messages he had sent via the defunct encrypted communication network EncroChat – a network the Kinahans have also used – to direct drug shipments.

The Sunday Times reports today on the Kinahan cartel’s deeply entrenched links to organised crime in the UK, where it is known to control much of the illicit drug market. It said the footage showing that Dixon and Jamieson know each other could indicate an underworld connection, since cartel cadres do not associate with rival operations.

Three of the seven alleged key Kinahan cartel figures have been arrested since the US sanctions were imposed. Johnny Morrissey, arrested in Spain in 2022, was later bailed and subject to a travel ban. Sean McGovern was jailed earlier this month and Daniel Kinahan awaits extradition to Ireland after his recent arrest in Dubai. Garda Commissioner Justin Kelly, of Ireland’s police force, recently said the investigation into the Kinahan cartel was ongoing and that authorities were continuing to focus on the other members of the gang.

Ian Dixon did not respond to questions from Bellingcat.

---

Connor Plunkett, Peter Barth, Beau Donelly and John Mooney contributed to this article. 

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

The post Poster Boy: Sanctioned Kinahan Cartel Lieutenant Found Playing Padel in Dubai appeared first on bellingcat.

Between February 2022 and September 2025, Bellingcat staff and volunteers collected, geolocated, and shared more than 2,500 incidents of civilian harm following Russia’s full-scale invasion of Ukraine. 

As part of this effort, Bellingcat tested a new machine learning model intended to rank Telegram social media posts on their likelihood of containing incidents of civilian harm. 

This novel methodology dramatically reduced the search and selection time required, freeing researchers to focus on verifying incidents of civilian harm – not just searching for them. 

This piece documents our methodology, ethical considerations and lessons learned in the hope that others researching similar topics can benefit from our work. 

Open source research into civilian harm is still a relatively new field and it presents many challenges – one of the biggest is organising and sorting through the huge volume of user generated content being produced to find what is relevant. 

Machine learning, a form of artificial intelligence that uses algorithms to identify patterns from large amounts of data and make predictions, can make this task more efficient.

With ongoing conflicts involving large amounts of civilian harm occurring in Sudan, and much of the Middle East, this guide aims to offer those covering these conflicts an example of how machine learning can be used to help find and sort incidents. You can also access the Code Notebook for our model here.

We defined “civilian harm” not just as civilian deaths or injuries resulting from armed conflict, but also the broader and delayed effects on civilians from mental trauma, loss of livelihood, displacement, destruction of infrastructure and more. This definition was informed by the Protection of Civilians book on civilian harm. 

Initial Telegram Dataset 

Each Telegram post containing civilian harm which had already been manually verified by researchers was used to build an initial dataset of confirmed cases of civilian harm, which data scientists call positive instances. We collected a total of 5,848 unique URLs for these Telegram posts. For our manual collection we reviewed posts on relevant Telegram channels, working through oldest to newest posts each day. Assuming that a given post made it to our geolocated incidents list, it meant the researcher who flagged it also looked at the posts that appeared before and after it on Telegram and did not flag those ones, so we selected the 10 posts surrounding the verified civilian harm post as our additional dataset of posts that did not contain civilian harm. After excluding any deleted or duplicate posts, we ended up with 48,545 non-civilian harm posts, our negative instances. 

The choice to overrepresent negative instances aims at better reflecting the real world and increasing data available for model training. 

We enriched each URL with metadata from the Telegram API, such as the time of publication, reactions or textual content. As some of these posts had been deleted, we completed the missing data points with previously preserved versions from our Auto Archiver database, only available for the positive instances.

Feature Engineering

Training a machine learning model requires numerical data, as these models compute a prediction score based on mathematical operations.

We built these by converting raw data from our initial dataset, such as keywords signalling potential civilian harm, into numerical scores (or “features”) that the model could interpret, with the aim of increasing the model’s ability to identify patterns. This process, known as feature engineering, can significantly improve model results because it allows data scientists to suggest explicit context knowledge. 

A full list of features we used to train the model can be found in the code notebook accompanying this piece. Many features were directly inspired by researchers’ input from their experiences manually screening cases of civilian harm by sorting through a set number of Telegram channels and inspecting each post individually.

Several of the features used were directly built from the metadata contained in each Telegram post including media_type, day_of_week; or binary ones: forwarded, edited and reply_to. 

Other features included engagement information: views, forwards, total_reactions, and even individual features for most used emojis including the reaction_crying_face to count emoji.

Converting Text to Numbers 

To embed the experience from the manual collection process, researchers put together a list of keywords both in Ukrainian and Russian that, to them, signalled posts likely to  show civilian harm. For instance, “Шахед” and “КАБ” translated to “Shahed” and “Guided aerial bomb” respectively. We created a numerical feature to count their frequency. 

In addition, we included several generic English-language keywords which meaningfully signalled potential civilian harm, such as “injured”, “school affected” and “hospital affected” that were only used for generating semantic similarity scores. 

A semantic similarity score is a calculation used to determine the proximity in meaning between different words and phrases. To get the semantic similarity between the post text and each of our keywords, we represented each in a list of numbers via a Sentence Transformer model, which converts words into numerical representations called vectors that a computer can understand. 

We then calculated the level of similarity between each vector using cosine similarity, one of the most popular methods for measuring similarity between two pieces of text.

Due to how embeddings work, this calculation results in a figure on a scale from -1 (no semantic proximity) to 1 (same meaning). For example, the words “hurt” and “injured” would have a high similarity score, while “residential” and “injured” would have a negative score as the words are not semantically similar. 

Finally, to enable the model to identify the relevance of each post to civilian harm in Ukraine, we used a multilingual text transformer from the BERT family of language models to represent the entire post’s text as a vector of 768 numerical values. This model can efficiently represent text from many languages in a way that captures meaning: the same sentence in different languages will generate similar embeddings, and trained machine learning models can detect patterns in the embeddings. 

It is important to note that for this initial prototype of a civilian harm detection model, we did not include any features derived from media content such as photos and videos, although that would be a logical next step in attempting to improve model performance.

Selecting, Training and Evaluating Models

With 54,393 rows of 893 numerical features each, we selected four machine learning algorithms to train our predictive models. 

We chose Logistic Regression as a baseline algorithm due to its simplicity. We also selected three other “best in class” models, Random Forest, XGBoost, and LightGBM. These choices centred on the interpretability of the models and their ability to work on tabular data of this size. For example, we avoided neural networks due to a lack of interpretability and because those models work best with a larger dataset. 

To genuinely assess the performance of the trained models, we split our dataset into three parts:  

• A training set – the data the models were trained on (60 percent of the full dataset’s rows)
• A validation set – used for an intermediary evaluation when tuning model parameters (20 percent of all rows)
• A test set – hidden for the final performance assessment, so the models were evaluated on unseen data (remaining 20 percent of rows)

We used a stratified split to divide the dataset instead of a random split. This method ensured the proportion of positive instances (i.e. confirmed cases of civilian harm) remained consistent across all three sets at about 11 percent.

To measure the performance of machine learning models, we ran them through the test set and measured the number of correct and incorrect predictions. Models output a likelihood between 0 and 1 that each Telegram post contains civilian harm, and we tried to find a cut-off threshold that leads to a good balance between flagging almost every post (0.1) or flagging very few (0.9). 

There are two main types of evaluation metrics to gauge a model’s prediction power. Recall asserts what fraction of positive instances (i.e. known civilian harm posts) were correctly flagged as such. Precision measures the fraction of posts flagged as civilian harm that are indeed civilian harm posts.

During the training phase, we tuned the models to maximise average precision (PR-AUC), a metric that summarises precision across all recall levels. While this method also accounts for precision, it prioritises recall, which is preferable for this use case as it steers model selection to reduce the number of civilian harm posts that are skipped. 

The following table sorts models from best to worst PR-AUC against a baseline of a coin-flip predictor. ROC-AUC and F1 are two other evaluation metrics included as sanity checks. Simply put, ROC-AUC measures the probability of ranking two instances, one negative and one positive, correctly; F1 balances precision and recall equally and its best cut-off threshold value.

From these results, we selected XGBoost as our final model as it had the best scores when compared across all metrics.

Interpreting the Model

Because these models are interpretable, we can understand which features are the most useful when predicting whether a post includes civilian harm. The above table shows the top 10 features that most strongly signal the XGBoost model to make a decision:

• semantic_keywords_similarity: the semantic proximity between the post text and manually selected keywords “casualties”, “damage” and “civilian harm”
• bert:  the model was able to discern meaning from the text with the same strength as some of the other features in this list – there are three cases of this in the top 10
• reaction_crying_face: reactions with crying face emojis on the post
• group_of_messages: whether a post contains multiple media files
• keywords_in_text: the number of custom Ukrainian or Russian keywords in the post

These results generally tally with what you might expect when selecting Telegram posts for instances of civilian harm, including that posts that generate a lot of emotional engagement and posts using keywords about civilian harm were among those most likely to contain content related to this topic. Not all models had the same top features as XGBoost. In fact, for the Random Forest model the most important feature was the number of crying face emojis present in a post, a soft pattern highlighted by researchers when this methodology was first imagined.

LLM Results and Comparison

Retroactively, we decided to run a sample of the same test dataset through different large language models (LLMs) to gauge their ability to make these same predictions. 

We aimed to include an LLM-generated score as an extra feature for our trained models, which would be captured as relevant if it correlated with the correct predictions. 

To start, we selected two local models, the 1B and 4B variants of Gemma 3 from Google DeepMind, and two cloud-hosted models, Gemini 2.5 flash and Gemini 3.5 flash. With this selection, we hoped to compare results across a wide range of models’ expected performance. 

We generated a 400-row stratified sample (preserving the same proportion of real civilian harm instances) from the test dataset used for the custom models. For each of the four LLM models, we ran two tests: one where only the Telegram post message was sent, and another including both the message and the engineered features (excluding the text embeddings, as the model had direct access to the text). In the prompt for each model, we asked for a score between 0 and 1. We then evaluated the results as we did for the custom models. 

The above table shows that LLMs can indeed extract value from the engineered features. All four LLMs surpassed the baseline Logistic Regression model in our tests, yet none of them performed better than the other custom-trained models, and XGBoost remained the one with the highest PR-AUC. 

Still, Gemini 2.5 Flash performed better than its newer version 3.5 and even achieved a slightly higher best F1 score than any other model. While this is a good result, for the flagging of civilian harm posts, the PR-AUC remains the crucial metric, as it captures the model’s ability to identify infrequent instances of civilian harm while minimising false positives.

Ethical Considerations

Introducing an instrument of automated decision-making into a process of detecting civilian harm brings inherent ethical questions. These include automation bias, or how humans tend to blindly place faith in machine-generated recommendations; algorithmic bias, or how the results of these models echo the same patterns present in the training data, including under- or over-representation of types of civilian harm. 

The decision to test an automated methodology for this particular project came from the fact that there were limited resources for both steps in the process – the detection of potential civilian harm and its actual verification. Historically, we built an enormous backlog of unverified incidents because a lot of time had to be spent on monitoring the most recent events so that potential evidence would be captured and preserved as soon as possible. 

The automation of this process also reduced the exposure of researchers to a significant amount of unpleasant and distressing visual and text content, reducing the burden of exposure to traumatic content. 

For this project, we tried to ameliorate the ethical challenges with a number of strategies including randomly flagging posts not captured by any model, monitoring which features models relied on to make decisions, and by doing historical comparisons of patterns in data. 

Additionally, as stated above, for this initial prototype of a civilian harm detection model we did not include any features derived from the media content itself. In the future, it would be a logical next step in attempting to improve the model performance, to include the media from the posts – but using AI to review actual media comes with additional ethical challenges such as model bias.

Because of the opaque ownership of many LLM companies and their generative nature, the use of LLMs for an extra feature presented additional ethical challenges including privacy and safety concerns considering the sensitive nature of the data. Our model did not rely on LLMs, though we retroactively ran a sample through it. 

How the Model Fits into the Bigger Picture 

After selecting this model, we created a user interface where researchers could view a list of Telegram posts sorted from most to least likely to contain indications of civilian harm. The user interface was designed for quick triage and integration, where a positive confirmation from researchers would instantly send the post to the Auto Archiver (Bellingcat’s tool for preserving digital content) and then transfer it to ATLOS (our internal collaborative verification platform). Bellingcat staff and volunteers could then manually verify incidents. Researcher input was constantly stored so that this data could be used to improve the model in the future. 

Preliminary feedback indicated that the AI model was useful. Not only were we able to reduce time and harm from scouring through dozens of war reporting Telegram channels, researchers also reported that the stream of new posts being added to the verification backlog were capturing real and diverse cases of civilian harm. 

We recognise this model has much room for improvement and is a work in progress. Even though it can illicit diverse civilian harm posts, further tests and improvements (such as improved feature engineering and continuous evaluation) are needed before it can confidently be deployed.

Despite the focus on civilian harm and Telegram (highly popular in Ukraine and Russia), this pipeline is generic and can be adapted to other conflict monitoring tasks. How easily this can be done does depend on how open the social media platform is and whether it is possible to scrape posts from it. Apart from that, it is easy to incorporate new features and data, and cheap to automatically retrain, test and deploy models as the system receives more human input.  

Looking forward, sorting through overwhelming amounts of data in a conflict will continue to be challenging. Hopefully, this methodology can help newsrooms, conflict monitoring organisations, and others find the balance between ethical considerations and resources in order to carry out open source investigations on civilian harm and human rights violations. 

---

Editor’s note: This article was updated on July 3, 2026, to include a line outlining that the model described is a work in progress.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

The post How to Use AI to Help Find Civilian Harm appeared first on bellingcat.

Warning: Includes graphic descriptions of animal harm and images of animal parts from the outset.

A Bellingcat investigation has uncovered a Myanmar-based wildlife trafficker who has operated openly across social media for at least six years, claiming to have sold tiger bones, rhino horn, elephant skin and other products from protected and endangered species to customers in Myanmar, China and Thailand.

By analysing hundreds of adverts and customer conversations, Bellingcat traced more than US$21,000 in sales, identified cross-border shipments linked to multiple payment accounts, and geolocated the dealer’s home address. The seller frequently used graphic images to convince buyers that his wildlife products were genuine, sharing footage of animals before and after they were killed as proof of authenticity.

Following this investigation, Meta removed 10 Facebook accounts, WeChat suspended three accounts and revoked their payment functions, TikTok and YouTube each removed one account, and authorities in Myanmar and Thailand said they would examine the findings further.

On December 21 2022, a Facebook account shared a reel of a tiger cub lying unconscious beneath the caption: “Time for winemaking”, followed by several laughing face emojis. Four days later, the same account shared another reel, this time of an adult tiger lying motionless on an orange plastic sheet as a man approaches with a knife.

Two separate videos posted to Facebook by the account known as MB.

The account behind both videos belongs to Mei Ba (hereafter MB), a self-described Traditional Chinese Medicine (TCM) doctor based in Myanmar. In TCM, plants and animal products are used to prepare remedies based on established medicinal formulas. These remedies can take many forms, including herbal teas, simmered concoctions, ingredients steeped in wine, and pills. TCM is also sometimes associated with pseudoscientific beliefs, such as the idea that consuming an animal’s organ can nourish the corresponding organ in the human body.

A Bellingcat investigation has found that MB frequently advertises the trafficked parts of critically endangered and vulnerable species to customers in Myanmar, Thailand and China. An analysis of social media posts published by MB over six years found references to sales involving parts of bears, elephants, leopards, musk deer, otters, pangolins, rhinos, seahorses and tigers, all of which are protected species.

Profiting from Protected Species

For at least six years, MB has used ten different Facebook accounts under versions of his name to advertise animal parts and products for sale, including those derived from vulnerable and protected species. 

MB has advertised tiger body parts and products, including skins and wine made from bones. Myanmar’s wild tiger population was last estimated at a minimum of 22 animals (in a 2019 study published before the civil war). Licensed tiger farms, described as being similar to zoos, also operate in the country. However, Myanmar law prohibits the killing of any tiger, wild or captive. 

Bellingcat has also identified adverts offering leopard body parts, including skin, bones and gallbladders, as well as a product described as a “whip”, a euphemism for a penis. Many of the adverts explicitly stated that the body parts came from wild animals. The Indochinese leopard is classified as critically endangered, with fewer than 800 mature individuals believed to remain in the wild across mainland South-East Asia.

MB has advertised body parts and other products derived from Asian elephants, an endangered species, including skin sold in pieces and powdered form, as well as their genitals.

One of MB’s more graphic posts showed a recently killed and butchered moon bear – a type of Asian black bear which is classified as a vulnerable species. MB has also advertised various bear body parts for sale, including paws, heads, gallbladders, bile and fat.

Whole rhino horns, as well as bracelets and medicinal products made from rhino horn, have been advertised by MB. Although rhinos have been extinct in Myanmar since the 1980s, the country remains a known transit route for rhino products moving from India to China and elsewhere in South-East Asia, suggesting the items advertised by MB originated outside Myanmar.

Rhino products as advertised by MB on Facebook. Labels added by Bellingcat.

Under Myanmar law, anyone convicted of killing, possessing or trading a “completely protected species,” or its parts, faces a minimum prison sentence of three years and a fine under a conservation law introduced in 2018. Completely protected species advertised by MB include Asiatic black bears, elephants, leopards and rhinos.

Bellingcat contacted multiple Myanmar government authorities for comment regarding MB’s wildlife trade. The Myanmar embassy in London confirmed receipt of Bellingcat’s request and said it would consult the relevant authorities in Myanmar. 

Convincing Customers

Counterfeits are common in the illegal wildlife trade. Buffalo horn is often carved to resemble rhino horn, while cattle penises are passed off as tiger parts. Much of MB’s promotional strategy therefore focuses on persuading buyers that his products are genuine. 

To market rhino horn, MB has posted images of the items on scales or held up against a light, which he claims demonstrates the texture of genuine horn. For tiger bones, in one post he said that a patch of skin would be left attached to demonstrate their authenticity. 

MB has also posted videos of recent leopard and tiger kills. He has shared footage of live tigers in cages followed by images of the same animals being butchered for their skins, bones, skulls, claws and fangs.

Bellingcat only analysed open source evidence, including social posts, customer conversations, visible transactions and shipping receipts. Therefore, the authenticity and composition of the wildlife products advertised or sold could not be independently verified.

Nevertheless, given the volume and graphic nature of these posts, MB’s ability to operate on Facebook for at least six years raises questions about why his accounts remained active up until Bellingcat contacted Meta.

Evading Platform Moderation

For years, MB has openly advertised his business on Facebook, posting hundreds of adverts across ten profiles and various groups. He often uses coded language, including Chinese-language euphemisms in his comments. 

For example, he uses “eraser” (橡皮) to refer to “elephant skin” (象皮), a Mandarin homophone with characters that are also visually similar, shown below.

MB also uses pinyin, the phonetic system for spelling Mandarin Chinese words using Latin letters. For example, in one post, he abbreviates the pinyin word for “rhino” (xīniú) as “X”, advertising “X horn powder”, and uses “Y” (pinyin: yào) as shorthand for “medicine”. He also frequently uses animal emojis, including tiger, elephant, rhino, deer and bear, to refer to products derived from those animals without naming them directly.

Asked why MB had been able to operate for so long without being banned and how it detects common evasion tactics such as coded language, Meta responded: “Bad actors constantly evolve their tactics to avoid enforcement, which is why we partner with groups and invest in tools and technology to detect and remove violating content.”

Cross-Border Trade

To map the scale of MB’s business, Bellingcat analysed more than 500 screenshots of customer conversations spanning May 2021 to May 2026. Originally taking place on Facebook, Viber and WeChat, these exchanges were later reposted by MB on Facebook.

Often blurred or cropped, the material appears to have been shared as part of a strategy to present MB as a trusted seller who reliably delivers to customers. However, given the content frequently included shipping labels with names and addresses, product descriptions, and price discussions, Bellingcat was able to trace part of MB’s customer base and income. Notably, only content MB chose to repost was available for analysis, meaning the findings represent only a sample of his overall activity. 

Across the dataset, Bellingcat identified more than 150 transactions totalling US$21,000. The United Nations estimated Myanmar’s annual per capita income at between $300 and $430 in 2023.

Bellingcat analysis of MB’s digital footprint showing revenue earned per species by MB. Currency in US$. Trade values are estimated based on yearly average black market exchange rates.

Based on delivery records, Bellingcat identified 119 deliveries within Myanmar, 27 to mainland China, and nine to Thailand. Within Myanmar, shipments were most often sent to shared pickup points in cities or towns, whereas those to China were more frequently sent directly to individual addresses. 

Shipments within Myanmar most often involved small quantities of powders or medicines, such as 3 to 7 g of rhino horn powder or 5 g of bear gall bladder. By contrast, deliveries to China more often included whole animal parts such as rhino horn or tiger bones, or larger quantities of products, including 500 g to 1 kg of elephant skin powder or 10 to 40 bottles of medicine.

MB’s highest-value recorded transaction was to a customer in Yiyang, Hunan Province, China and involved two tiger femur bones weighing just over 2.5 kg. Sold in July 2022, the bones fetched 23,500 Chinese Yuan (US$3,494). The customer was asked to provide a screenshot as proof of payment. MB later reposted this on Facebook, alongside a photograph of the bones wrapped in cling film and a shipping label for Deppon Logistics attached. 

Bellingcat contacted Deppon Logistics for comment, sharing the image and tracking number shown below, but received no response at the time of publication.

Under Chinese law, buying, transporting, or selling protected or endangered species can, in the most serious cases, carry prison sentences of more than 10 years. Asian elephants and wild tigers are listed as “Class 1” protected animals. A permit system does exist for the use of captive-bred tigers, although it remains controversial. 

Under the Convention on International Trade in Endangered Species of Wild Fauna and Flora (CITES) Appendix I, international trade in any endangered species, including Asian elephants and tigers, as well as their derivatives such as skin powder, scales and bones, is prohibited. China, Myanmar and Thailand are all parties to the treaty. 

Bellingcat contacted the General Administration of Customs of China for comment on MB’s wildlife sales to China but did not receive a response at the time of publication.

Bellingcat also found evidence of nine deliveries to Thailand, including a tiger penis and several TCM powders said to contain dog, yak and seahorse, all species regulated by Thai law and protected under CITES.

The Thai Natural Resources and Environmental Crime Division told Bellingcat that it already monitors packages falsely declared as traditional medicine but found to contain protected wildlife parts or ingredients derived from them. Following Bellingcat’s findings on MB’s activities, the division said it would investigate further.

A large proportion of MB’s exports to all three countries were bottles of TCM powders or tablets. For example, a “kidney replenishing medicine” was purported to contain deer, dog, gecko, praying mantis, seahorse and yak, while a “prostate medicine” was said to include deer, seahorse and dog. 

Under Chinese law, all packaged TCMs must carry labels clearly displaying the manufacturer’s name, full ingredient list, production and expiry dates, and information on side effects and safety. None of these details were present on MB’s labels.

Multiple banks accounts

Over six years of reposted conversations with customers, Bellingcat observed MB requesting payments to at least 15 different accounts, including seven via WeChat Pay, two via Alipay and six via third-party bank accounts, which MB described as belonging to friends or family.

For example, in May 2022, a customer purchased 1kg of elephant skin powder to be shipped to Chiuchow, Guangdong Province, China. MB told the customer his WeChat account could not currently receive the payment and instructed them to send the funds to his “sis” [female associate], shown below.

Both WeChat Pay and Alipay’s terms and conditions prohibit the use of their services to receive payments for illegal activities.

After being contacted by Bellingcat, WeChat suspended three accounts, revoking all payment functions and removing associated content. 

Alipay did not respond to Bellingcat’s request for comment.

Identifying MB

MB’s brazen online activities include operating at least ten Facebook profiles, two TikTok accounts, one WeChat account and one YouTube channel. He is the sole administrator of a Facebook group with nearly 1,000 members. Across these platforms, he has amassed some 12,000 followers. 

While using variations of “Mei Ba” (MB) across most of these accounts, he also uses the Chinese name “Mei Xiangfu” on his personal WeChat account. The name “May Kyin Phu” also appears alongside payment QR codes when customers are asked to transfer funds. Below is a QR code for Myanmar’s largest bank, KBZ, which includes what appears to be MB’s legal name: U May Kyin Phu, with “U” used as an honorific equivalent to Mr.

Since 2019, MB has used the same ID photo as his profile picture across multiple platforms, as well as his wedding photo as his TikTok profile picture and Facebook banner image. His wife, identified in the wedding photo and in other images posted by MB, has also been found advertising vulnerable and protected species via her Facebook account.

With more than 3,100 followers, she frequently reposts MB’s adverts while also sharing screenshots of conversations with customers. For example, in one WeChat exchange later reposted to Facebook, she discusses the cash sale of five “real” tiger penises.

From MB’s posts, Bellingcat geolocated a house in Lashio, eastern Myanmar, used to photograph animal parts for sale in his advertisements. MB has posted content from this property since 2020.

In the images below, what MB describes as “leopard gallbladders” can be seen hanging from a balcony, revealing the layout of the property’s backyard and the rooftops of adjacent buildings. Although Lashio is not covered by Street View, the distinctive roof visible in MB’s images matched with user-uploaded photographs on Google Maps.

Bellingcat contacted both MB and his wife for comment on the findings of this report. Both were reached via WeChat and appear to have received the request, but did not reply at the time of publication.

---

Data visuals by Galen Reich, Graphics by Merel Zoet, Editor, Claire Press.

Bellingcat is a non-profit and the ability to carry out our work is dependent on the kind support of individual donors. If you would like to support our work, you can do so here. You can also subscribe to our Patreon channel here. Subscribe to our Newsletter and follow us on Bluesky here, Instagram here, Reddit here and YouTube here.

The post Rhino Horn, Leopard Skin and Tiger Claws Sold Openly on Facebook appeared first on bellingcat.