An advisor to al-Qaida. One of the founders of Hezbollah. The head of an Iraqi militia group known for attacks on U.S. troops. And a top official with the Houthi rebels who recently lashed out at the “criminal Trump.”

These are among the U.S.-sanctioned terrorists who appear to have paid, premium accounts on Elon Musk's X, a new Tech Transparency Project investigation has found, raising questions about the platform's dealings with individuals who have been deemed a threat to U.S. national security.

Regulations enforced by the Treasury Department’s Office of Foreign Assets Control (OFAC) prohibit U.S. companies from engaging in transactions with sanctioned individuals or entities unless they are licensed or otherwise authorized by the government. X’s policies explicitly state that its premium services are off limits to users subject to OFAC sanctions.

But TTP found premium blue checkmark accounts for multiple terrorists and others under OFAC-enforced sanctions. Some of these accounts even had an “ID verified” badge, meaning that X confirmed their identity after they submitted a government-issued ID and a selfie to the company. Several made use of revenue-generating features offered by X, including a button for tips.

The findings add to questions, first raised by TTP in February 2024, about X’s adherence to sanctions designed to protect U.S. national interests, even as the company maintains it has a “robust and secure” approach to its monetization features. X, formerly known as Twitter, once handed out blue checkmarks to notable figures for free. But after taking over the company, Musk turned the blue checkmark into a paid product and required users to purchase a premium subscription to obtain them.

X’s ongoing dealings with U.S.-sanctioned terrorists on its platform are all the more striking given that Musk, who has been leading the Trump administration’s so-called Department of Government Efficiency (DOGE), chastised the Treasury Department in February for lacking “basic controls” to track payments and ensure they don’t end up going to terrorist organizations and other wrongful recipients. Speaking at a televised Oval Office appearance with Trump, Musk said such controls are “in place in any company.”

X did not provide a comment on the findings when contacted by TTP.

X says it uses three companies for ID verification. Two of the companies, Au10tix and Persona, did not respond to a request for comment. A third company, Stripe, declined to comment.

Before the Musk acquisition, Twitter had a long-established policy of providing blue checkmarks to notable organizations and individuals at no cost. But after buying the company in 2022, Musk began a chaotic transition to a paid verification system in which blue checkmark holders pay for premium service.

Under X’s current rules, users need to have a subscription to X Premium or Premium+, or be affiliated with a Verified Organization, to get a blue checkmark. X Premium costs $8 per month or $84 per year, and Premium+ costs $40 per month or $395 per year. Verified Organization status is available via one of two paid tiers: Basic for $200 per month/$2,000 per year or Full Access for $1,000 per month/$10,000 per year. (Verified Organizations get Premium+ service.)

According to X, premium accounts can get a blue checkmark “after a review to ensure subscribed accounts meet all eligibility criteria.” The platform makes clear that users are prohibited from using premium service if they are under U.S. economic sanctions, including sanctions enforced by OFAC.

Premium subscribers have access to a variety of additional perks, including the ability to edit posts, post longer text and videos, and create “communities” around specific topics. They can also get a cut of certain kinds of ad revenue and charge subscription fees for bonus content.

Another perk available to premium accounts: They can get an “ID verified” badge for their account if they submit a government-issued ID and a selfie to X to confirm their identity. The badge is meant to prevent impersonation and “increase the overall integrity and trust on our platform,” according to X, which says ID verified accounts get “prioritized support.”

OFAC regulations prohibit transactions with sanctioned individuals and entities including the “making of any contribution or provision of funds, goods, or services by, to, or for the benefit of any blocked person and the receipt of any contribution or provision of funds, goods, or services from any such person.” The office has warned that violations can result in civil or criminal penalties and that civil liability may apply even in cases where the U.S. party “did not know or have reason to know” they were engaging in a prohibited transaction.

When pre-Musk Twitter allowed U.S.-sanctioned individuals and groups to use free accounts on the platform, some legal experts argued that arrangement was permissible under U.S. sanctions law. But providing a paid service to sanctioned people or groups appears to be a different matter because it involves a financial transaction. TTP found no indication that X has sought or received a license to do business with U.S.-designated terrorists and other sanctioned entities. (Because OFAC's language prohibits the “contribution” of services to blocked persons, sanctions may also apply if special services are provided at no cost.)

OFAC has taken enforcement action against at least one major U.S. tech company in recent years. In November 2019, the office announced a settlement with Apple for hosting apps from a Slovenian software company in violation of Foreign Narcotics Kingpin Sanctions Regulations. OFAC noted that it could have fined Apple up to $74 million for the violation but significantly reduced the penalty given that Apple voluntarily self-disclosed the issue and the violations were “non-egregious.” The office said Apple had taken steps to “minimize the risk of recurrence of similar conduct in the future.” (The company ultimately paid $466,912 to settle the matter.)

X’s response to TTP’s first report about terrorist accounts on X, in February 2024, suggests the company is aware of the dangers of providing paid perks to sanctioned entities. Hours after that report was published, X removed checkmarks from all the accounts mentioned in the report, and it later suspended many of the accounts. In an X post that same day, the company said it has “a robust and secure approach in place for our monetization features, adhering to legal obligations, along with independent screening by our payments providers.” It said some of the accounts identified by TTP "may have visible account check marks without receiving any services that would be subject to sanctions.”

X's clean-up effort appears to have been short-lived. TTP’s new investigation found an array of blue checkmark accounts for U.S.-sanctioned individuals and organizations, including several that appeared to simply re-subscribe to premium service or create new accounts after their old ones were restricted or removed by X. The research was conducted between November 2024 and April 2025.

TTP was not able to determine who runs these accounts day-to-day. X says it reviews accounts before giving them a blue checkmark to ensure they “meet all eligibility criteria.” Moreover, some of the accounts were “ID verified,” meaning X conducted an additional review to confirm their identity. The accounts all clearly identified themselves as individuals or organizations that are under U.S. sanctions, and the content they post is consistent with the messaging of those individuals or organizations. Because OFAC prohibits providing services “for the benefit of any blocked person,” sanctions may apply in cases where aides or colleagues are running a premium account in the name of a sanctioned person.

Below are examples of X blue checkmark accounts for individuals and organizations that are listed as Specially Designated Nationals by OFAC. Specially Designated Nationals’ assets are blocked, and “U.S. persons,” a category that includes U.S. citizens and permanent residents as well as U.S.-incorporated entities, are prohibited from engaging in transactions with them without authorization.

TTP identified the following X blue checkmark accounts for Houthi leaders that are listed as Specially Designated Nationals by OFAC. The Iran-backed Houthi militia, also known as Ansarallah, controls northern Yemen and has carried out drone and missile attacks on Israel and commercial shipping in the Red Sea in solidarity with Hamas during its war with Israel. Shortly after taking office in January 2025, President Trump re-designated the Houthis a Foreign Terrorist Organization, ratcheting up sanctions on the group that had been partially lifted by the Biden administration. The U.S. launched a series of airstrikes against Houthi targets in Yemen starting in March 2025, but Trump halted the bombing in early May, saying the Houthis had promised to stop targeting ships.

The Treasury Department has issued a series of general licenses covering certain activities in Houthi-controlled areas of Yemen, including provision of telecommunications and internet services, but these services remain off limits to Specially Designated Nationals.

Mahdi al-Mashat, the chairman of the Houthi Supreme Political Council, appears to have a blue checkmark using the handle @Preesident_Ye. The account has a banner image of Al-Mashat and identifies itself in Arabic as “Presidency of the Republic of Yemen.” (Al-Mashat is often referred to as the president of Yemen by pro-Houthi media.) The account, which has more than 1,600 followers, indicates it was created in January 2025 and verified with a blue checkmark in April, a month after OFAC announced sanctions against al-Mashat and others accused of procuring and smuggling weapons for the Houthis. Some of the account’s posts exceed 280 characters, a benefit of X Premium status. (Premium subscribers can go up to 25,000 characters per post.) The account had a blue checkmark in March 2025, which disappeared briefly before returning.

Al-Mashat is subject to Global Terrorism Sanctions Regulations and “secondary sanctions” based on executive orders seeking to disrupt terrorist financing. (Secondary sanctions apply to parties outside U.S. legal jurisdiction.)

On May 6, the day Trump announced the truce with the Houthis, the al-Mashat account posted a statement saying the Houthis had “indirectly informed the Americans that the continued escalation will affect the criminal Trump's visit to the region, and we have informed them of nothing else." It added, “President Al-Mashat indicated that if the criminal Trump wanted to stop his aggression and make up for what he had left behind, that was up to him.” The account also posted a statement saying the Houthis will continue attacks on Israel.

Abdul al-Khaiwani, the head of security and intelligence for the Houthis and a key member of the group’s leadership structure, appears to have a blue checkmark account with the handle @AlKhaywani_ye. The account, which has over 600 followers, shows it was created and verified in August 2024. It clearly states al-Khaiwani’s name and title in Arabic, identifying him as “Head of the Security and Intelligence Service – Yemen.” The account regularly posts lengthy videos, a benefit of X Premium status. (Regular X accounts have a video limit of 140 seconds.)

OFAC announced sanctions against al-Khaiwani in December 2020, during the first Trump administration, saying he was responsible for security forces and facilities involved in the illegal arrest, detention, and torture of women. Al-Khaiwani is subject to Global Magnitsky Sanctions targeted at people involved in human rights abuses and corruption.

TTP identified the following X blue checkmark accounts for Hezbollah and Hamas entities that are listed as Specially Designated Nationals by OFAC. They are all subject to Global Terrorism Sanctions Regulations and secondary sanctions aimed at disrupting terrorist financing. Both Hezbollah, which is based in Lebanon, and Hamas, which operates in the Gaza Strip, are militant groups backed by Iran. Hamas-led gunmen attacked southern Israel on Oct. 7, 2023, killing 1,200 people and taking hundreds hostage. The attack sparked an Israeli military campaign that has killed more than 50,000 Palestinians, according to Palestinian health authorities. Hezbollah and Hamas are themselves under OFAC sanctions.

Subhi Tufayli, a founder of Hezbollah who served as the group’s first secretary-general, appears to have a blue checkmark account with the handle @sobhitfaily. The account, which has more than 40,000 followers, was created in February 2016 and verified in October 2023, the same month that Hezbollah began firing rockets into Israel following the Hamas-led attack on the country. The account clearly identifies itself in Arabic as the “official account of the former Secretary-General of Hezbollah, His Eminence Sheikh Subhi al-Tufayli.” It also shows it is “ID verified,” meaning X confirmed the user’s identity via a government-issued ID and a selfie. The account regularly posts videos exceeding 30 minutes in length, a benefit of X Premium status which allows for longer videos.

OFAC announced sanctions against Tufayli in January 1995, describing him as a “senior figure” in Hezbollah. Trump updated sanctions on Tufayli as part of an executive order issued in September 2019.

Hassan Moukalled, described by OFAC as a key Hezbollah money exchanger, appears to have a blue checkmark account with the handle @hasmokaled. After TTP’s February 2024 report identified this account, X quickly removed its blue checkmark. But the account re-acquired a blue checkmark a month later, in March 2024. The account, which was originally created in July 2016, has more than 60,000 followers. OFAC announced sanctions against Moukalled, a Lebanon-based economist, in January 2023, saying he plays a key role in helping Hezbollah to “exploit and exacerbate Lebanon’s economic crisis.” Moukalled and his company CTEX are both under U.S. sanctions. He has denied that he or his company have financial ties to Hezbollah.

When TTP tried the Grok AI button on Moukalled’s X account, the AI-generated summary said Moukalled "passionately champions resistance, critiques foreign influence in Lebanon, and honors martyrs with fiery posts," adding that the "X community" praises him "for his economic insights and principled stances." The summary contained no mention of Hezbollah. Musk, who has been developing Grok and integrating it into X, has said the chatbot is “designed to have a little humor in its responses.”

Gaza Now, the Hamas-aligned media outlet, appears to have a blue checkmark account with the handle @gazaalannet. The account, which has more than 45,000 followers, was created in October 2023 and verified with a blue checkmark in June 2024, more than two months after OFAC announced sanctions on the site. OFAC has identified the term “gazaalannet,” the name of this X handle, as one of Gaza Now’s aliases. The account has a profile image of Gaza Now’s logo and describes itself as “our new and only official account.”

The @gazaalannet handle regularly retweets posts from a larger Gaza Now account with more than 462,000 followers and an account for Gaza Now’s founder and director, Mustafa Ayash. Neither of those accounts has a blue checkmark, but the larger account has posted that it lost its verification marks after the U.S. and UK imposed sanctions on Gaza Now.

The @gazaalannet handle is taking advantage of its premium status to raise funds: It has a “subscribe” button, a feature that lets premium users charge fees for bonus content. The feature is only available to premium users and requires an application to participate. X takes a cut of any subscription fees.

OFAC has described Gaza Now and its founder Ayash as “key financial facilitators involved in fundraising for Hamas” following the Hamas-led attack on Israel on Oct. 7, 2023. Ayash is also under OFAC sanctions.

TTP identified the following X blue checkmark accounts for Syrian individuals who are listed as Specially Designated Nationals by OFAC. The country of Syria and its government have been under longtime comprehensive sanctions, but President Trump, during his visit to Saudi Arabia on May 13, said he would remove all sanctions on Syria. A day later, he met with Syrian President Ahmad al-Sharaa, the former rebel leader who helped to topple the country’s longtime dictator, Bashar Assad.

It is not clear if Trump has already taken action on the removal of Syria sanctions. In the meantime, a general license issued by the U.S. government authorizes certain internet-based communications services in Syria, but they remain off limits to Specially Designated Nationals.

Ahmad al-Sharaa (aka Abu Mohammed al-Golani), the Syrian rebel leader who was declared the country’s president following the overthrow of Assad, appeared to have a blue checkmark account for roughly four months despite being under OFAC sanctions. Al-Sharaa led the Syrian rebel coalition Hayat Tahrir al-Sham, which evolved from the al-Qaida affiliate Nusra Front. He appeared to have an X account with the handle @SCAhmadSharaa that received a blue checkmark in August 2024. The account got that blue check even though al-Sharaa had been under OFAC sanctions since 2013 and had a $10 million U.S. bounty on him at the time. In mid-December 2024, shortly after al-Sharaa made international headlines for ousting Assad and seizing power, his X account was suspended. That timeline means X was providing premium service to al-Sharaa for about four months.

During the period when al-Sharaa’s blue checkmark account was active, it had an “ID verified” badge, indicating that X confirmed the user's identity via a government-issued ID and a selfie. The account also had button for accepting tips. The tips feature—which is available to all X accounts, not just premium subscribers—lets users contribute cash or cryptocurrency to an account. X’s tipping policy says users must comply with sanctions to use the feature. (Terrorists have been increasingly relying on crypto to shield their assets from traceability of traditional banking systems.)

Following Assad’s ouster, al-Sharaa said all Syrian rebel factions, including his own group Hayat Tahrir al-Sham, would be disbanded as he seeks to unite the country under one government and bring an end to international sanctions. For the time being, OFAC continues to list him and Hayat Tahrir al-Sham as subject to terrorism-related sanctions.

Mohammed Hussein al-Jasim (aka Abu Amsha), leader of the Suleiman Shah Brigade, a Turkey-backed militia active in northern Syria, appears to have a blue checkmark account with the handle @abo33amsha. The account, which has more than 162,000 followers, was created in June 2017 and verified in March 2023. OFAC announced sanctions against al-Jasim in August 2023, saying members of his brigade had been directed to forcibly displace Kurdish residents and seize their property and kidnap local residents for ransom. OFAC also pointed to allegations that al-Jasim had raped the wife of a member of his brigade and threatened her and her family to remain silent.

Al-Jasim is subject to Syria-related sanctions from a 2019 Trump executive order. According to the Kurdish news website Rudaw, al-Jasim continues to stoke violence in northern Syria, leading an assault on a Kurdish civilian in the city of Afrin in March 2025. The Suleiman Shah Brigade is itself subject to U.S. sanctions.

Walid Hussein al-Jasim, the younger brother of the abovementioned Mohammed al-Jasim, also appears to have an X blue checkmark account with the handle @sayfamsha. Like Mohammed, Walid is as a Specially Designated National. OFAC said he often led the Suleiman Shah Brigade while his brother was fighting in Libya and was involved in “abductions, muggings, and ransoms.” According to OFAC, Walid has also faced allegations of sexual assault and reportedly killed a prisoner. Walid al-Jasim’s X account profile links to his Facebook page, where he lists his job, in Arabic, as “Commander-in-Chief of the Sultan Suleiman Shah Division.” 

TTP identified the following blue checkmark accounts for Iraqi figures who are listed as Specially Designated Nationals by OFAC.

Haydar Muzhir Ma'lak al-Sa’idi (aka Haider al-Gharawi), the leader of Harakat Ansar Allah Al-Awfiya, an Iranian proxy militia in Iraq, appears to have a blue checkmark account with the handle @Haider_Gharawi. The account, which has nearly 2,700 followers, was created in November 2021 and verified in September 2024. OFAC announced sanctions against al-Sa’idi in June 2024. He is subject to multiple terrorism-related sanctions. According to the State Department, Harakat Ansar Allah Al-Awfiya is part of a coalition of groups that has claimed responsibility for attacks against U.S. military personnel in Iraq and Syria. The militia is subject to the same sanctions as Al-Sa’idi.

Qais al-Khazali, the leader of another Iran-backed militia in Iraq, Asa’ib Ahl al-Haq, appears to have two blue checkmark accounts in his name. One with the handle @khazalimedia, which has more than 5,700 followers, was created and verified in February 2025. It describes itself in Arabic as the “official account of the media office of His Eminence Sheikh Qais Khazali.” The other, with the handle @Qais__Iraq, had 13,700 followers. It was created in December 2020 and verified in December 2024.

Both accounts give their professional category as “Media Personality.” X requires users to convert their profile into a “professional account” to list a professional category like this. According to X, professional accounts give users the “ability to grow and strengthen their presence” on the platform. They get access to special features including an analytics dashboard and a suite of products for selling goods directly on X.

OFAC announced sanctions against al-Khazali in December 2019, saying he was one of several militia leaders whose groups opened fire on peaceful protests in Iraq, killing dozens of people. Al-Khazali’s militia, Asa’ib Ahl al-Haq, has been involved in “widespread forced disappearances, abductions, killings, and torture, targeting Sunni Iraqis with impunity,” OFAC said. The militia is also known for attacks on U.S. military and diplomatic personnel in Iraq, including a 2007 assault in Karbala, Iraq that left five U.S. soldiers dead. Al-Khazali is subject to Global Terrorism and Global Magnitsky sanctions and secondary sanctions on terrorist financing.

Ahmed al-Jubouri (aka Abu Mazen), a member of Iraq’s parliament and former governor of the country’s Salahuddin province who was once jailed for corruption, appears to have a blue checkmark account, @Abo_Mazann. The account, which has nearly 23,000 followers, shows it was created in February 2020 and verified in November 2024. It also has an ID verified badge. The account clearly identifies itself in Arabic as “Dr. Ahmed Abdullah Abdul-Jubouri...Abu Mazen.” OFAC announced sanctions against al-Jubouri in July 2019, saying he “has been known to protect his personal interests by accommodating Iran-backed proxies that operate outside of state control.” He is subject to Global Magnitsky Sanctions.

TTP identified the following blue checkmark accounts for Kuwait-based individuals who are listed as Specially Designated Nationals by OFAC. Each individual is subject to Global Terrorism Sanctions Regulations and secondary sanctions related to terrorist financing.

Abd al-Muhsin Zabin Mutib Naif al-Mutayri, who is accused of raising funds for Nusra Front, the al-Qaida affiliate group in Syria, has a blue checkmark account with the handle @q8azm. (The Extremist Monitoring Analysis Network identifies this as his official X account.) The account, which has more than 188,000 followers, was created in February 2011 and verified in December 2024. OFAC announced sanctions on al-Mutayri in May 2016, saying he used charities to raise money for Nusra Front and collected money to support the group’s fighters in Syria. Nusra Front later evolved into Hay’at Tahrir Al-Sham, which is under OFAC sanctions.

Hajjaj Fahd Hajjaj Muhammad Shabib al-‘Ajmi, another Kuwaiti accused of financing Nusra Front, appears to have a blue checkmark account with the handle @ok1aj. (Arabic-language media outlets have identified the account as belonging to Al-Ajmi.) The account, which has 219,000 followers, was created in February 2017 and verified in January 2023. OFAC announced sanctions on al-‘Ajmi in August 2014, saying he served as a “funnel for financial donations to ANF [Nusra Front] facilitators in Syria.” Al Ajmi frequently complains on X about being under U.S. sanctions.

Al-‘Ajmi’s presence on Twitter, as X was formerly known, was the subject of court proceedings nearly a decade ago. In 2016, a U.S. magistrate judge approved an effort to serve al-‘Ajmi, via Twitter, with a lawsuit seeking damages for thousands of Assyrian Christians targeted by terrorist attacks in Iraq and Syria. (The case was later dismissed.)

Shafi Sultan Mohammed al-Ajmi, a third Kuwaiti accused of raising funds for Nusra Front, appeared to have a blue checkmark account for roughly a year. The account, with the handle @DRSHAFIALAJMII, has more than 229,000 followers and was created in March 2011. At the time of TTP’s research, it had a blue checkmark and showed it was verified in January 2024, but the checkmark disappeared sometime after Jan. 2, 2025. While it had a blue check, the account showed it was ID verified, meaning X confirmed the user’s identity via a government-issued ID and a selfie. The account handle matches one of al-Ajmi’s aliases listed in the OFAC database.

The account’s X feed includes multiple videos in the two- to three-minute range, a length only available to Premium subscribers. OFAC announced sanctions against Al-Ajmi in 2014, saying he acted as a fundraiser and arms smuggler for Nusra Front.

TTP identified the following X blue checkmark accounts for members of Iran’s government who are listed as Specially Designated Nationals by OFAC. They are all subject to Iran sanctions from a 2019 Trump executive order, as well as secondary sanctions. During his May 13 speech in Saudi Arabia, President Trump, whose administration is holding nuclear talks with the Iranian government, called Iran "the most destructive force" in the Middle East and said the U.S. would never allow it obtain a nuclear weapon.

Vahid Haghanian, a close aide to Iran’s Supreme Leader, Ayatollah Ali Khamenei, appears to have a blue checkmark account with the handle @vahid_haghanian. The account, which has more than 4,000 followers, indicates it was created in May 2024 and verified in July 2024. The account’s bio section states clearly that Haghanian is a “Senior official in the Supreme Leader's Office (30 years).”

OFAC announced sanctions against Haghanian and other members of Khamenei’s inner circle in November 2019, describing them as a “shadow network” of advisors to the Supreme Leader that has “oppressed the Iranian people, exported terrorism, and advanced destabilizing policies around the world.” According to OFAC, Haghanian, a former commander of Iran’s Islamic Revolutionary Guard Corps, is known as the Supreme Leader’s “right hand.” The Haghanian X handle exactly matches the English spelling of his name in OFAC’s public database.

Mohsen Rezaei, a longtime member of Iran’s Expediency Council, an advisory body to the Supreme Leader, appears to have a blue checkmark account with the handle @ir_rezaee. The account, which has more than 195,000 followers, shows it was created in August 2015 and verified in January 2025. The Rezaei account often posts messages exceeding 280 characters, a perk provided to premium subscribers.

OFAC announced sanctions on Rezaei and other senior Iranian officials in January 2020, saying they had “advanced the regime’s destabilizing objectives.” Rezaei, a former commander of Iran’s Islamic Revolutionary Guard Corps, is suspected of involvement in the 1994 bombing of a Jewish community center in Buenos Aires, Argentina that left 85 people dead. He has been on an Interpol “Red Notice” wanted list for years in connection with the attack. In January 2020, the Rezaei X account threatened to “take severe revenge on America” in retaliation for the U.S. drone strike that killed Iran’s top military commander, Qassem Soleimani.

Mohammed Javad Zarif, who served as Iran’s foreign minister, has a blue checkmark account with the handle @JZarif. (The Iranian mission to the United Nations identifies this account as belonging to Zarif.) The account, which has 1.6 million followers, shows it was created in June 2009 and verified in 2014. This indicates Zarif received a free blue checkmark prior to Musk’s acquisition of the company, but under Musk, X has required “legacy” verified accounts like this one to subscribe to premium service to retain the blue check.

OFAC announced sanctions on Zarif in July 2019, saying the then-foreign minister “implements the reckless agenda of Iran’s Supreme Leader, and is the regime’s primary spokesperson around the world.” The announcement also said the foreign ministry under Zarif’s leadership “coordinated with one of the Iranian regime’s most nefarious state entities,” the Quds Force of Iran’s Islamic Revolutionary Guard Corps. (The Quds Force and the Revolutionary Guards are also under U.S. sanctions.) Zarif, who helped negotiate the Iran nuclear deal with the Obama administration, later served as Iran’s vice president of strategic affairs until resigning in March 2025. Trump pulled out of the nuclear deal in 2018.

Jamil el-Sayyed, a Lebanese lawmaker accused of smuggling money out of the country in the midst of a financial crisis, appears to have a blue checkmark account, @jamil_el_sayyed. The account, which has more than 790,000 followers, was created in December 2015 and verified in October 2017. X has required “legacy” verified accounts like this one, which received a blue checkmark prior to Musk’s acquisition of the company, to pay for premium service to keep the check. OFAC announced sanctions against el-Sayyed in October 2021, saying he “sought to skirt domestic banking policies and regulations and was aided by a senior government official in transferring over $120 million to overseas investments, presumably to enrich himself and his associates.” According to OFAC, el-Sayyed also called for officials to shoot and kill anti-corruption protestors outside his home. He has denied the accusations.

El-Sayyed, a former Lebanon intelligence chief, was reportedly close to the now-deposed Syrian dictator Bashar Assad and Hezbollah. He is a Specially Designated National subject to Lebanon-related sanctions.

Saadi Gadhafi, a son of the late Libyan dictator Muammar Gadhafi, had a blue checkmark account, @SaadiQaddafi, that was suspended after being identified in TTP’s February 2024 report. But he created a new X account, @Asaadialqaddafi, in June 2024 and got it verified with a blue checkmark the same month. The new account has more than 16,000 followers and shows it is “ID verified.” Gadhafi’s website links to this account, specifically to a post claiming that his original account was “hacked.” (The post did not mention that the account was removed following TTP’s 2024 report.) OFAC announced sanctions on Saadi Gadhafi and other members of the Gadhafi family and government in March 2011, part of an effort to freeze the regime’s assets. (Muammar Gadhafi was captured and killed by rebel forces later that year.) Al-Saadi is a Specially Designated National subject to Libya-related sanctions.

Raghad Saddam Hussein al-Tikriti, a daughter of late Iraqi leader Saddam Hussein, appears to have a blue checkmark account with the handle @RghadSaddam. The account, which has more than 658,000 followers, was created in April 2016 and verified in March 2023. It posts frequent tributes to Saddam Hussein, referring to him as a martyr. (Saddam was hanged in 2006 after being captured by U.S. troops and sentenced by an Iraqi court to crimes against humanity.) OFAC announced sanctions against Raghad al-Tikriti in March 2004 along with other family members and associates of Saddam Hussein. It was part of an effort to identify and freeze the regime’s funds and use them for Iraqi reconstruction. Raghad al-Tikriti is a Specially Designated National subject to Iraq-related sanctions from executives orders in 2003 and 2004.

Adib Shaban al-Ani, described as the former chief of staff for Saddam Hussein’s son Uday Hussein, appears to have a blue checkmark account using the handle @adibesaeed. The account, which has more than 2,200 followers, was created in October 2011 and has been verified with a blue checkmark since July 2023. OFAC announced sanctions on al-Ani in May 2004 as part of an effort to uproot the “sordid underworld of the Hussein family's finances.” According to OFAC, Al-Ani was one of the “key financial lieutenants” to Uday Hussein, who presided over an “illicit commercial empire founded on a variety of smuggling, racketeering and embezzlement schemes.” (Uday Hussein was killed in a gun battle with U.S. soldiers in 2003.) Al-Ani is a Specially Designated National subject to Iraq-related sanctions.

Abu Hafs al-Mauritani (aka Mahfouz Ould al-Walid), who served as an advisor to Osama bin Laden and al-Qaida, appears to have a blue checkmark account with the handle @AbuHafsMuritani. (The George Washington University Program on Extremism identifies the account as belonging to Hafs.) The account, which has more than 31,000 followers, was created in June 2016 and verified in December 2024. Its checkmark disappeared in February 2025 but reappeared in April. Hafs has used his premium account to post extended text and videos.

OFAC announced sanctions on Hafs on Sept. 24, 2001, just weeks after the 9/11 attacks, as part of a George W. Bush executive ordering targeting terrorists. Al-Walid reportedly spent years in custody in Iran and Mauritania before being released in 2012. He is listed as a Specially Designated National subject to Global Terrorism sanctions regulations and secondary sanctions aimed at disrupting terrorist financing.

The X accounts described above are for Specially Designated Nationals who all have been sanctioned by OFAC. By providing them with paid, premium blue checkmarks, X appears to be violating sanctions that bar U.S. companies from transacting or dealing with sanctioned individuals and entities.

In addition to displaying blue checkmarks, some of the accounts showed they were “ID verified,” meaning X put them through an extra layer of review designed to prevent impersonation. TTP also found several accounts making use of X’s revenue-generating features to make money off their followers. X’s own policies state that its premium services are off-limits to parties sanctioned by OFAC.

TTP’s investigation identified additional blue checkmark accounts for users who were not individually sanctioned by OFAC but are associated with sanctioned entities, including the Houthis in Yemen, Syrian and Iraqi militia groups, and the government of Iran. These accounts, described below, raise further questions about X’s approach to sanctions.

The Houthis appear to be particularly reliant on X for their messaging. After X removed the Houthis’ main blue checkmark account after it was identified in TTP’s February 2024 report, the group took to its Telegram channel to call the action “contrary to all human rights laws.” A few weeks later, an X account for Hussain al-Ezzi, the Houthis’ self-proclaimed deputy foreign minister, appealed directly to Musk to allow the group back on the platform.

“I stand in solidarity with the Yemeni brothers who had the blue mark removed from their accounts, and I call on Elon Musk to reinstate it, or at least reinstate subscriptions,” the al-Ezzi account wrote. It warned that “any continued tampering with the accounts of Yemeni revolutionaries and activists on the X platform” would result in a “comprehensive boycott.”

The Houthi boycott never occurred, and it does not appear that X ever addressed the boycott threat. Today accounts for a number of Houthi officials are making heavy use of X for messaging and propaganda. They include:

• Nasruddin Amer, a Houthi spokesman, appears to have a blue checkmark account with the handle @Nasr_Amer1. The account gives one of his titles as “Deputy Chairman of the Ansar Allah Media Authority.” It regularly uses X Premium features like extended posts and longer videos. The account, which has over 353,000 followers, was created in September 2017 and verified in May 2024.
• Hashem Sharaf al-Din, another Houthi official, appears to a blue checkmark account with the handle @hashemsharafden. The account, which has more than 13,000 followers, was created in July 2024 and verified the following month. It gives al-Din’s titles as “Minister of Information” and “Spokesman for the Government of Change and Construction,” the Houthi leadership’s term for its cabinet. Al-Din appears to have a second “unofficial” blue checkmark account with the handle @hashemsharafdin. That account, which has 71,000 followers, was created in December 2013 and verified in November 2023. It comes with an X warning that the profile “may include potentially sensitive content,” but users can simply click a button to access it. Both accounts post messages exceeding 280 characters, a perk of X Premium service.
• Dhaif al-Shami, who has previously served as the Houthis’ information minister, appears to have a blue checkmark with the handle @DhaifAlShami650. It describes al-Shami as a “Member of the Political Bureau of Ansar Allah.” The account, which has over 246,000 followers, frequently posts long videos. It was created in June 2020 and verified in October 2024. (The account’s checkmark briefly disappeared in February 2025 but was restored the same month.)
• Hizam al-Asad, who has also been identified as a Houthi official in media reports, appears to have a blue checkmark account with the handle @hezamalasad. It gives his title as “Member of the Political Bureau of Ansar Allah.” The account, which was created in May 2012 and verified in November 2024, has more than 117,000 followers. It has a button accepting cryptocurrency tips using Bitcoin and Ethereum.

TTP identified a number of blue checkmark accounts for members of Syrian and Iraqi militia groups that are under U.S. sanctions.

• Mazhar al-Wais, a key figure in the Syrian militia Hay’at Tahrir Al-Sham who was recently tapped by the country’s new president Ahmad al-Sharaa to serve as justice minister, appears to have a blue checkmark account with the handle @maabdwalshamee1. The account clearly states in Arabic that it belongs to al-Wais, and local broadcaster Syria TV has attributed the account to him. The account, which has more than 39,000 followers, was created in March 2020 and verified in January 2025. As noted previously, Hay’at Tahrir Al-Sham, which evolved from the al-Qaida affiliate Nusra Front, is a Specially Designated National subject to multiple terrorism-related sanctions.
• The Joint Force, which is composed of two U.S.-sanctioned Syrian militias—the Hamza Division and the Suleiman Shah Brigade—appears to have a blue checkmark account with the handle @ortakkuvvaten. The account, which was created and verified in August 2024, features the Joint Force logo in its banner and profile images, and a pinned post at the top of its feed promises updates on the Free Syrian Army, a Turkey-backed umbrella group of rebel factions that includes the Joint Force. TTP identified what appear to be two other X accounts for the Joint Force—@ortakkuvvattr and @ortakkuvvat—which had blue checkmarks in December 2024 but later lost them.
• Surajuddin Zureiqat, who led a U.S.-sanctioned terrorist group called the Abdallah Azzam Brigades that operated in Syria, Lebanon, and the Arabian Peninsula, appears to have a blue checkmark account with the handle @siraje_eddine. The account, which has more than 35,000 followers, clearly states in Arabic that it belongs to Zureiqat. It was created in February 2017 and verified in May 2023. Zureiqat announced the dissolution of the Abdallah Azzam Brigades in 2019, though it remains under OFAC-enforced terrorism sanctions. The group, which had ties to al-Qaida, was known for threatening U.S. interests in the Middle East.
• Hajj al-Suwaidi, a member of the U.S.-sanctioned Iraqi militia Asa'ib Ahl Al-Haq, appears to have a blue checkmark account with the handle @haj_alswedy. (The organization’s website identifies al-Suwaidi as one of the group’s officials.) The account, which includes Asa’ib Ahl Al-Haq’s flag in its profile photo and in a post pinned to the top of its feed, has more than 30,000 followers. It was created in October 2021 and verified in June 2024.
• Al Ahad News, the media arm of Asa'ib Ahl Al-Haq, has a blue checkmark account that is linked directly from the outlet’s website. The account, which uses the handle @ALAhadNewsAg, has more than 2,200 followers. It was created in October 2023 and verified with a blue checkmark in February 2024. (The blue checkmark briefly disappeared briefly in March 2025 but returned later that same month.)
• Nazem al-Saeedi, a leading figure in the U.S.-sanctioned Iraqi militia Harakat Al-Nujaba, appears to have a blue checkmark account with the handle @Nazem_AlSaeedi. The account, which has more than 600 followers, identifies al-Saeedi as “Head of the Executive Council of the Islamic Resistance Movement, Al-Nujaba,” which matches his title given on a Harakat al-Nujaba website. The account was created in March 2024 and verified in October of that year. Harakat Al-Nujaba is subject to Global Terrorism Sanctions Regulations and secondary sanctions on terrorism financing. According to the U.S. State Department, the group has “pledged its loyalties to Iran and Iranian Supreme Leader Ayatollah Khamenei.”

The government of Iran is under longtime sanctions enforced by OFAC and the U.S. Commerce Department’s Bureau of Industry and Security. According to U.S. regulations, the government of Iran includes “any entity owned or controlled directly or indirectly” by the government.

OFAC has issued a number of general licenses carving out exemptions in the Iran sanctions, including one from 2022 that pertains to social media and internet services. This general license allows U.S. tech companies to offer services to the Iranian people to help them evade digital surveillance and censorship. It gives the government of Iran to access such services but only if they are “publicly available” and “at no cost.” That appears to rule out U.S. tech companies selling or providing special services to Iranian government entities.

But TTP found that X provided paid blue checkmarks to several Iran government-linked accounts:

• Ali Larijani, a senior aide to Iran’s supreme leader Ayatollah Ali Khamenei, appears to have a blue checkmark account with the handle @alilarijani_ir. The account, which clearly states the account belongs to Larijani, has more than 81,000 followers. It was created in May 2021 and verified in September 2024. Larijani is a longtime figure in Iranian government circles and previously served as speaker of the country’s parliament. He has been channeling the supreme leader’s views amid wrangling with the Trump administration about new nuclear talks, at one point warning that Iran would have to acquire a nuclear weapon if attacked by the U.S. or its allies.
• Sattar Hashemi, Iran’s minister of communications and information technology, appears to have a blue checkmark account with the handle @HashemiSattar. The account, which has more than 19,000 followers, was created in August 2019 and verified in December 2024. It clearly states Hashemi’s government title in Farsi.
• Abdolnaser Hemmati, who until recently served as Iran’s economy and finance minister, appeared to have a blue checkmark account with the handle @Hemmati_ir. The account, which has more than 105,000 followers, was created in May 2021 and verified in April 2024. It had a blue checkmark in early December 2024, but the check was removed sometime after that. Hemmati was ousted from his government position in March 2025. While the account had a blue checkmark, it posted extended text and video—perks available to Premium subscribers.
• Al-Alam, a state-run Iranian television network, lost its primary X blue checkmark account after it was identified in TTP’s February 2024 report. But the network later acquired a pair of new blue checkmark accounts on X. One account with the handle @alalam_ar was created and verified in October 2024. It is featured on Al Alam’s official Telegram account. The other account, with the handle @alalammoraselin, was created in February 2020 and verified in May 2024. It is linked on the “how to watch” page on Al-Alam’s website. Al-Alam is part of Islamic Republic of Iran Broadcasting, which is subject to sanctions enforced by OFAC.
• Iran in Arabic, an Iranian government news agency, has a blue checkmark account with the handle @iraninarabic_ir. The account, which is linked on the website for Iran in Arabic, says the organization is the “Voice of the Islamic Republic of Iran in the Arab World” and is approved by Iran’s Ministry of Culture and Islamic Guidance. The account has more than 714,000 followers and shows it was created in February 2020 and verified in August 2023.