Conflict Has a Domestic Signature
Grayline Intelligence identifies, classifies, and analyzes threats to U.S. interests arising from geopolitical escalation and gray zone activity. Developed by Spectra Intel Group (SIG), the platform transforms open-source reporting into structured, analyzable threat intelligence through systematic OSINT monitoring, AI-assisted extraction, and analyst-reviewed classification.
This dataset currently emphasizes incidents linked to the second-order effects of the U.S.–Iran conflict and related foreign-directed or foreign-inspired threat activity.
Foreign escalation. U.S. exposure. Structured for analysis.
This dataset captures observed incidents, disruptions, and credible threat activity affecting U.S. interests, structured for longitudinal analysis across geography, attribution, and method.
March 29, 2026
MEDIUM
Frontier Airlines Verbal Bomb Threat at Atlanta Airport
Atlanta, Georgia – Hartsfield-Jackson Atlanta International Airport
0 Killed
0 Injured
Bomb Threat (verbal)
Unknown; under investigation
Under Investigation
Suspect
Unknown; identity not released
Source Type
Media
Threat Type
unknown
Target Type
infrastructure
Intent
unknown
Outcome
failed
Confidence
0.65
Notes
- Flight 2539 from Columbus, Ohio landed at Hartsfield-Jackson Atlanta International Airport and was taxiing to the gate shortly after 5 p.m. when a passenger made a verbal bomb threat.
- The aircraft was directed to a remote location away from the terminal while law enforcement responded to investigate.
- Passengers were taken off the plane and bused to the terminal.
- Authorities determined that the threat made by the passenger was not credible.
- Atlanta police said the incident involved an 'unruly passenger' and the situation is not currently being treated as a hijacking.
- The Federal Bureau of Investigation is leading the investigation into the incident.
- Officials have not yet released the identity of the passenger or confirmed if any charges have been filed.
Sources
Submitted URL
March 27, 2026
HIGH
Iran-Linked Hackers Breach FBI Director Patel Personal Email
United States – specific location unknown
0 Killed
0 Injured
Cyber intrusion / email account compromise
Handala Hack Team (Iran Ministry of Intelligence and Security-linked)
Confirmed
Suspect
Handala Hack Team operatives; $10 million FBI reward for identification; at large
Source Type
Media
Threat Type
hybrid
Target Type
government
Intent
symbolic
Outcome
completed
Confidence
0.9
Notes
- Hackers connected to the Iranian government accessed FBI Director Kash Patel's personal email and posted materials including photos and documents taken from his account.
- The stolen emails appear to date from around 2011 to 2022 and include personal, business and travel correspondence.
- The FBI confirmed the breach and stated no government information was obtained.
- The FBI is offering a $10 million reward for information leading to the identification of the Handala Hack Team.
- US intelligence officials warned about the possibility of Tehran-linked hackers retaliating for US and Israeli bombing of Iran that began last month.
- This is not the first time Iranian-backed hackers accessed Patel's private information; he was targeted in late 2024 as part of a broader effort by foreign hackers.
- The Justice Department has accused the hackers of working for Iran's Ministry of Intelligence and Security.
- The same hacking group was behind a cyberattack earlier this month that disrupted business operations at a major US medical device maker.
Sources
Submitted URL
March 23, 2026
HIGH
Golders Green Synagogue Ambulance Arson Attack
London, United Kingdom – Machzikei Hadath synagogue, Golders Green
0 Killed
0 Injured
Incendiary Device
Unknown; under investigation
Confirmed
Suspect
Three masked individuals, at large
Source Type
Media
Threat Type
terrorism
Target Type
religious
Intent
symbolic
Outcome
completed
Confidence
0.85
Notes
- Four of six ambulances belonging to Hatzola Northwest, a Jewish volunteer rescue organization, were deliberately set on fire outside Machzikei Hadath synagogue at approximately 1:36 a.m. on Monday.
- Security camera footage showed three masked individuals approach and ignite the ambulances.
- Counter-terrorism police are leading the investigation, though it has not yet been officially deemed a terrorist incident.
- Police are treating the attack as an antisemitic hate crime.
- Explosions were caused by gas canisters and oxygen tanks on board the ambulances.
- Each ambulance costs approximately £125,000 ($166,000).
- The British government announced it will replace the four destroyed ambulances.
- Golders Green is home to London's largest Jewish community with many synagogues, schools, and kosher restaurants.
Sources
Submitted URL
March 20, 2026
HIGH
Iran Threatens Global Tourism Site Attacks Amid US-Israel-Iran War
Multiple locations – Iran, Israel, Gulf Arab States, Iraq
0 Killed
0 Injured
Missiles, Drones, Airstrikes
Iran / Islamic Revolutionary Guard Corps
Confirmed
Suspect
Iranian government and military leadership; Gen. Ali Mohammad Naeini (killed in airstrike); Ayatollah Mojtaba Khamenei (current Supreme Leader)
Source Type
Media
Threat Type
terrorism
Target Type
infrastructure
Intent
mass_casualty
Outcome
completed
Confidence
0.85
Notes
- Iran threatened Friday to expand its retaliatory attacks to include recreational and tourist sites worldwide.
- Iran's top military spokesman Gen. Abolfazl Shekarchi warned that parks, recreational areas and tourist destinations worldwide won't be safe for the country's enemies.
- More than 1,300 people have been killed in Iran during the war; more than 1,000 killed in Lebanon; 15 killed in Israel by Iranian missiles; at least 13 U.S. military members killed.
- Gen. Ali Mohammad Naeini stated Iran continues to manufacture missiles despite Israel's claim of destroying production capabilities; he was later killed in an airstrike.
- NATO pulled several hundred personnel out of Iraq and relocated them to Europe after Iranian attacks on British, French and Italian bases.
- Two waves of Iranian drones attacked Kuwait's Mina Al-Ahmadi refinery, one of the largest in the Middle East.
- Brent crude oil soared to around $108 per barrel from roughly $70 before the war began.
- The war began February 28, 2026 with U.S. and Israeli strikes that killed Ayatollah Ali Khamenei and other top Iranian leaders.
Sources
Submitted URL
March 20, 2026
MEDIUM
Anacostia Park Skating Pavilion Shooting
Washington, DC – Anacostia Park Skating Pavilion
0 Killed
1 Injured
Firearms
Unknown; under investigation
Under Investigation
Suspect
Unknown
Source Type
Media
Threat Type
unknown
Target Type
crowd
Intent
unknown
Outcome
completed
Confidence
0.65
Notes
- US Park Police responded around 1:15 pm to reports of gunfire near the park's skating pavilion.
- One person sustained non-life-threatening injuries.
- The agency stated there is 'no known threat to the public.'
- The park has been closed as the investigation continues.
- Local media reported the shooting occurred near an Eid al-Fitr event in the park.
- Witnesses cited by FOX 5 DC said multiple shots were heard, prompting people to flee the area.
Sources
Submitted URL
March 19, 2026
HIGH
DOJ Disruption of Iranian MOIS Cyber-Enabled Psychological Operations
United States – National (domains seized via District of Maryland)
0 Killed
0 Injured
Cyber Operations / Domain Seizure
Islamic Republic of Iran – Ministry of Intelligence and Security (MOIS)
Thwarted
Suspect
MOIS actors; no individual arrests announced in this release
Source Type
Government
Threat Type
terrorism
Target Type
government
Intent
targeted
Outcome
thwarted
Confidence
0.92
Notes
- Four domains seized: Justicehomeland[.]org, Handala-Hack[.]to, Karmabelow80[.]org, and Handala-Redwanted[.]to.
- Domains were used by MOIS for psychological operations, claiming credit for hacks, posting stolen PII, and calling for the killing of journalists, dissidents, and Israeli persons.
- On March 11, 2026, Handala Hack claimed credit for a destructive malware attack against a U.S.-based multinational medical technologies firm.
- Approximately 190 individuals associated with the Israeli Defense Force and Israeli government had their PII posted with threatening language on March 9, 2026.
- Death threats were sent via Handala_Team@outlook[.]com to Iranian dissidents and journalists in the U.S. and abroad, offering $250,000 bounties and referencing CJNG cartel partnerships.
- The U.S.-Iran conflict referenced as beginning on February 28, 2026.
- The Justicehomeland[.]org domain was previously used in July and September 2022 to claim responsibility for stealing documents from Albanian government organizations.
- Department of State's Rewards for Justice program is offering up to $10 million for information on persons engaged in malicious cyber activities against U.S. critical infrastructure.
Sources
Submitted URL
March 12, 2026
CRITICAL
Old Dominion University ROTC Classroom Shooting
Norfolk, Virginia – Old Dominion University ROTC classroom
1 Killed
2 Injured
Firearms
Islamic State (ISIS)-inspired; prior terrorism conviction
Confirmed
Suspect
Mohamed Bailor Jalloh, 36, killed by students during attack
Source Type
Media
Threat Type
terrorism
Target Type
campus
Intent
mass_casualty
Outcome
completed
Confidence
0.92
Notes
- FBI Director Kash Patel confirmed the shooting is being investigated as an act of terrorism.
- The gunfire erupted shortly before 11 a.m. in an ROTC classroom at Old Dominion University.
- The victim, Army Lt. Col. Brandon A. Shah, was an ROTC instructor killed in the attack.
- Two other U.S. Army personnel were injured according to Army Secretary Dan Driscoll.
- The gunman Mohamed Bailor Jalloh shouted 'Allahu Akbar' and was subdued and killed by students.
- Jalloh had previously pleaded guilty to terrorism-related charges involving a plot to murder US military personnel and attempting to provide material support to ISIS.
- Jalloh was sentenced to 11 years in prison in 2017 and was released in 2024.
- In 2016, Jalloh attempted to buy an AK-47 but was refused, then purchased an AR-15 at a local gun store before his arrest.
Sources
Submitted URL
March 12, 2026
HIGH
Temple Israel Synagogue Vehicle Ramming and Shooting Attack
West Bloomfield, Michigan – Temple Israel synagogue
1 Killed
31 Injured
Vehicle Ramming, Firearms, Incendiary Device
Unknown; under investigation as targeted antisemitic violence
Confirmed
Suspect
Ayman Mohamad Ghazali (preliminary identification), naturalized U.S. citizen from Lebanon, deceased
Source Type
Government + Media
Threat Type
terrorism
Target Type
religious
Intent
mass_casualty
Outcome
failed
Confidence
0.88
Notes
- Suspect rammed a vehicle into Temple Israel synagogue and drove down the hallway with purpose before exiting with a rifle.
- Armed security personnel engaged the suspect with gunfire and shot and killed him.
- The vehicle caught fire inside the building, filling the hallway with heavy smoke and flames.
- One security guard was injured after being struck by the suspect's vehicle.
- Approximately 30 law enforcement officers were hospitalized for smoke inhalation after entering the building.
- All 140 students in the synagogue's early childhood center, along with staff and teachers, were accounted for and unharmed.
- FBI is leading the investigation as a 'targeted act of violence against the Jewish community.'
- Suspect preliminarily identified as Ayman Mohamad Ghazali, born in Lebanon in 1985, who became a U.S. citizen on February 5, 2016.
Sources
Submitted URL
March 10, 2026
HIGH
Central Islip Molotov Cocktail Arrest
Central Islip, NY – Lexington Avenue
0 Killed
0 Injured
Incendiary Device
Unknown; non-terrorism related per law enforcement
Thwarted
Suspect
Lorenzo Alvarado-Navarrete (18), Elvis Romero-Martinez (20), Albert Yanes-Moran (20) – all arrested and released without bail
Source Type
Media
Threat Type
criminal
Target Type
residential
Intent
targeted
Outcome
thwarted
Confidence
0.8
Notes
- Suffolk County police pulled over a 2008 Honda Accord allegedly driving erratically shortly before 2:30 a.m. Tuesday on Lexington Avenue in Central Islip.
- Officers discovered two Molotov cocktails—beer bottles packed with gasoline—inside the vehicle.
- Three Salvadoran nationals were arrested and charged with third-degree criminal possession of a weapon.
- Romero-Martinez, the driver, was also issued multiple traffic summonses.
- All three were arraigned Wednesday and released without bail due to New York's bail reform laws.
- Prosecutors revealed that the three were planning to torch the car of someone they had a personal dispute with.
- Police determined the incident was non-terrorism related.
Sources
Submitted URL
March 9, 2026
MEDIUM
HAYI Pro-Iranian Hybrid Attack Campaign in Europe
Multiple European locations – Netherlands, Belgium, France, United Kingdom
0 Killed
0 Injured
Multiple methods (Incendiary Device, IED, Explosive Device)
HAYI (Harakat Ashab al-Yamin al-Islamia) – suspected Iranian state-coordinated hybrid operation
Under Investigation
Suspect
Multiple suspects arrested across Europe; investigation ongoing into Iranian state coordination
Source Type
Media
Threat Type
hybrid
Target Type
religious
Intent
symbolic
Outcome
completed
Confidence
0.75
Notes
- A pro-Iranian group called HAYI (Harakat Ashab al-Yamin al-Islamia) claimed responsibility for attacks on Jewish communities and American interests in Europe starting March 9, 2026.
- Incidents include an arson attack on Jewish community-run ambulances in the UK, an explosive device detonated at a synagogue in Belgium, and a foiled attack on a Bank of America office in France.
- The International Centre for Counter-Terrorism found no references to HAYI prior to March 9, 2026, suggesting the group may be a facade for Iranian state operations.
- Counterterrorism experts compare the pattern to Russia's hybrid operations, where individuals are recruited online to carry out sabotage attacks for small amounts of money.
- In the Netherlands, HAYI claimed an explosion outside a Rotterdam synagogue and an attack on a Jewish school in Amsterdam.
- Dutch Justice Minister David van Weel said suspects were most likely recruited and authorities are investigating possible Iranian involvement.
- Belgium's terror threat level remains at 'serious' with heightened vigilance for Israeli, Jewish, American and Iranian interests.
- A separate attack near the Israeli consulate in Istanbul was connected to ISIS, with 198 ISIS-linked suspects detained nationwide.
Sources
Submitted URL
This platform is being developed to improve detection of emerging threat patterns and support better decision-making across government, academic, and security stakeholders.
Disclaimer
This platform is based on open-source reporting and should be treated as OSINT. Facts, motivations, affiliations, and legal conclusions may change as investigations proceed. Unless explicitly confirmed by official authorities, all activities, attributions, and linkages should be considered under investigation.