BlackNest: Inside Canary Mission’s Secret Web of Unlisted Sites
One Canary Mission-affiliated website, BlackNest, reveals the group's internal operations, plans to expand, and how they celebrate deportations and firings
More and more, legacy media brands are becoming entrenched in authoritarianism, becoming complicit mouthpieces for the powerful and corrupt. Drop Site News was founded to combat this shift: to report free from undue influence, shed light on dark dealings, and amplify silenced voices. To operate as a truly independent organization, we rely entirely on the generosity and support of our community of readers. Please consider making a 501(c)(3) tax-deductible donation to support our work.
Notorious pro-Israel doxxing outfit, Canary Mission, has an army of anonymous doxxers, international tech vendors, marketing plans, and a secret website called BlackNest, where the group celebrates deportations and firings as “company impact” metrics, according to a collection of unlisted websites discovered by Drop Site.
BlackNest is just one of the names of several unlisted websites and content management systems used by Canary Mission, whose doxxing operation is run out of Israel and used by the highest levels of the Trump administration. The information on these unlisted websites—including dozens of names of workers and contracted vendors,internal communications about meetings and quarterly plans, and even strategic planning documents—demonstrates how the operation evolved over time.
Canary’s non-public websites promise expansion into new avenues to continue the group’s mission of punishing Americans for pro-Palestine speech via doxxing, pressure campaigns, and now arrests and deportations carried out by allies in the State Department.
BlackNest’s web development content reveals how Canary Mission thinks of its “wins” in its efforts to influence U.S. policy. The website categorizes the group’s impacts into categories: “Change of behavior,” job loss, denials of entry to the U.S., arrests, and “deportation/forced to flee.” The site also collects mentions of Canary Mission in media, mostly from U.S. news outlets, and celebrates mentions of their impact.
Drop Site News previously reported how donations are funneled to the group, but who the employees are, how the group functions, and who built their websites have been unknown—due to Canary Mission’s secrecy. Drop Site has now obtained over 100 gigabytes of content and data that was accessed via the backend of Canary Mission’s website, leading to a host of websites that were live but not intended to be found publicly.
A group of software engineers shared the data they collected from BlackNest’s daily updates over a period of three months last year, archived by the engineers in May, June, and July. The website was being actively developed and updated daily with an infographic of “news, articles, and impacts,” when researchers archived the site over the summer. BlackNest was hosted on an intranet URL called Kaloustropous, a term which roughly translates from Greek as “good manners.” The engineers were able to see the Kaloutstropous URL in the web development tools on the Canary Mission’s submission form page. From there, they found many unlisted subdomains that contained gigabytes of data used for Canary Mission ranging from social media screenshots used in the site’s profiles of targets to an internal site called BlackNest.
Inside BlackNest
Much of the BlackNest content has a corporate business tone and offers a view into a hierarchical and professionalized operation. A “Team Overview” page lists a staff achievement of someone named “Cheri,” who “identified the activist from” a viral video, and “Nora” is lauded for completing “the Stanford Arrest Profiles.” A “Team Updates” section offers a “Branding Update,” with instructions to the team to add a tagline to all posts about New York City mayor-elect Zohran Mamdani: “A vote for Mamdani is a vote for chaos in NYC.” Canary Mission added several students to the site after they were arrested at pro-Palestine protests at Stanford University in 2024, and emails and Instagram posts in June from Canary Mission contained the Mamdani tagline.
On another day, a listed team achievement was “Senator John Fetterman received our Philly report from multiple sources.” A campaign timeline hints at future areas of focus, including MIT, University of New Mexico, and “Harvard (Major Campaign.)” The Philly report might refer to a section on Canary Mission called “Philadelphia’s Network of Hate,” published June 2025.
BlackNest also collected and posted news articles about Canary Mission, including deportations and instances of people choosing to flee the U.S. in the wake of arrests that unfolded since President Donald Trump took office. When NBC reported that the Department of Homeland Security testified in court that they used Canary Mission to choose targets for deportation in July, BlackNest uploaded a PDF of the article to the “Impacts” section of the site.
BlackNest also contains hints of Canary Mission’s day-to-day operations. The time zones of documents uploaded to the backend of the sites correspond to Israel. A calendar page captured one day in July shows the content team’s schedule. “Phil” and “Amanda” led a marketing team Monday morning and on Wednesday there was a “Popcorn Hour” for content strategy.
A page called “Content Strategy Team” listed five categories of “active campaigns”: MIT, Harvard, Dartmouth, Stanford Arrests, and “Indigenous Rights/PYM,” which was labeled “not in production.” Canary Mission has sections of the site dedicated to campaigns at those universities, and it has a section dedicated to grassroots organization Palestinian Youth Movement or PYM. The content team was broken down into four smaller teams—profiles, editorial, reports and social media. The social media subteam was tasked with a KPI, or key performance indicator of five posts per day, focusing on Iran and Mamdani.
On the Impact section of BlackNest, the website celebrates “company impacts” to “track external influence.” In June, in a section called “profile impact tracking,” a blurb from a piece in The Nation was tagged as “High Impact,” with a subcategory button reading “self-deportation.” The excerpt was from a May editorial by Abdelrahman ElGendy, an Egyptian writer who fled political imprisonment in Egypt. He wrote about deciding to flee the U.S. after seeing the arrest of Mahmoud Khalil, knowing he, too, was on Canary Mission’s site as a target.
One of the categories of the Impacts page is simply called “ICE” and another is dedicated to English rap duo Bob Vylan, targeted by Canary and other Zionist voices for chanting “Death to the IDF” at a concert.
A landing page on BlackNest describes the “Company Impact” section as a place to “Track external company impacts, stakeholder feedback, and measure our influence across different initiatives and campaigns.” It’s unknown if the term “stakeholders” here refers to Canary Mission donors or other entities.
Users uploaded social media profiles and other personal information of Canary Mission’s targets to the Intranet site. They show how many employees the group appears to have, although most use pseudonyms, like “Ned Flanders” and “Halle Comet.” One doxxer’s social media profile belonged to a man whose name appears in the Megamot filings—”Alex Carson.” An “Alex Ben Carson” also appears in Megamot Shalom’s business filings for several years and is listed as a content writer making approximately $80,000 in 2022. Carson appears to be a UK-born writer specializing in pro-Israel content who moved to Israel in 2008, according to an archive of his now-defunct blog. He did not answer emails from Drop Site. Megamot Shalom has been reported to be the Israeli nonprofit running Canary Mission’s operations for years.
Over 30 unique “doxxers” appear to have created fake Facebook and other social media accounts to track and screenshot information about profiled pro-Palestine activists and students. They then upload it to a content management system using mostly anonymous emails. The fake Facebook accounts are friends with each other, and the created identities are all presented as Americans of varying ethnic backgrounds.
Canary Mission’s Future—and Abandoned Plans
The website data Drop Site accessed also reveals the future plans of the operatives of Canary Mission. A 21-page strategic planning document was included on BlackNest as a downloadable PDF for one day in July before being deleted. The document outlines the group’s mission, areas of focus, core values, targets, and a plan for 2025 that involves sharing data with donors.
In the PDF, the group lists its core values as: Follow daas torah (a concept in Orthodox Judaism about rabbinical authority), integrity, passion for the cause, anonymity, no-ego team player, and rosh gadol (or Hebrew slang for someone “seeing the big picture”).
“Fight those who hate the Jewish people” is the listed purpose, and the group’s niche is “dismantle the anti-Israel network by attacking the messenger, not the message.”
Canary’s PDF outlines the group’s core targets from 2021 to 2024 as dismantling the “core 7: AMP, SJP, INN, JVP, CAIR, WOL, FJP,” referring to major pro-Palestine student and activist groups and nonprofits.
Another target chart shows Canary Mission’s efforts to hold Zooms, webinars and meetings with donors, and also indicates they communicated with donors via email. Donations to Canary Mission are largely secret, as they are funneled through an American nonprofit to an Israeli nonprofit.
The group lists bullet points in the “Target” section of the document: “Anonymity as a tool to scare the enemy,” “Bottom-up Approach: Using individuals to take down orgs,” “We change the behavior of the enemy,” and “We are the adult in the room.”
The year-plan for 2024 noted “facial rec software combined with scraping is efficiently producing named POIs,” or persons of interest. A security audit was implemented, the document stated. For 2025, Canary Mission’s goals included distinguishing their brand from competitors and sharing data with donors. For the first quarter of the year a “rock,” or priority, was “Legal clarity on scale-up and Protocol Optimization for Profiles.” One measurable goal for the team in 2025 was for 150 new profiles to be written per week.
Last year, the operators of Canary Mission apparently started to create a spinoff Google chrome extension and website called the Museum of Online Antisemitism that seems to be abandoned. The Museum of Online Antisemitism seems to have been intended as a sort of private Wayback Machine for alleged antisemitism.
Screenshots from employees of the doxxing material for the site show they had the Chrome extension installed, and user names for the app’s code developers match those on Canary Mission’s backend. The creators of MOA added code to cover up social media user names of anyone screenshotting content, to help keep doxxers private, and also looked for ways to better archive dynamic sites and social media sites that are typically hard to archive with existing tools, the software engineers explained.
A description on the about page for the Chrome extension reads, “The Museum of Online Antisemitism (MOA) is a state-of-the-art, fast, and reliable archiving platform specifically for the pro-Israel and Jewish world to preserve the evidence of antisemitism.”
One Israeli company appears to have built code for both the Museum of Online Antisemitism and Canary Mission. Shefing is located in a WeWork in Jerusalem, and is owned by a French-Israeli man named Philippe Cohen. Cohen describes Shefing as “a boutique software consulting and service agency.” Shefing’s Github contains several custom software tool modifications that are used by both the Museum of Online Antisemitism extension and the Canary sites.
Cohen did not answer messages and emails.
 | A guest post by
|
I have had the distinct pleasure of making it to the canary list. Got fired as a physician in NY. I get detained at customs now. No one will hire me. It’s literally insane. My crime? Criticizing the IOF and denouncing the mass rape hoax of 10/7.
Thank you Drop Site for this work!