U.S. Armada: An OSINT intelligence guide to the naval build-up near Iran
Tracking the USS Abraham Lincoln, strike group identifiers, and Iranian countermeasures with real-time digital forensics.
U.S. President Donald Trump announced this week that a “massive armada” was heading to Iran. It came amid threats that he would use military power against the Iranian regime, which is currently violently cracking down on a protest movement that began late last year.
In a post on Truth Social on Wednesday, January 28, Trump said: “A massive Armada is heading to Iran. It is moving quickly, with great power, enthusiasm, and purpose. It is a larger fleet, headed by the great Aircraft Carrier Abraham Lincoln, than that sent to Venezuela.”
The USS Abraham Lincoln is a Nimitz-class ‘supercarrier’, which can carry up to 90 aircraft (warplanes and helicopters) and has an unlimited range due to the fact that it is nuclear-powered.
The carrier strike group, led by the USS Lincoln but including a number of other ships like guided-missile destroyers, is “currently deployed to the Middle East to promote regional security and stability”, according to U.S. Central Command in a post on January 26.
Among the vessels travelling with the USS Abraham Lincoln are the USS Spruance, the USS Frank E. Petersen Jr., and the USS Michael Murphy.
As tensions between the U.S. and Iran rise and bring the looming threat of a sudden escalation, this comprehensive intelligence guide provides hyperlinked tools and technical data required for an OSINT investigation.
1. Battle card
A. US naval & air strike force (CSG-3)
Flagship: USS Abraham Lincoln (CVN-72) – Confirmed operating in the Arabian Sea as of January 26.
Carrier Air Wing 9 (CVW-9): Includes F-35C Lightning II (VMFA-314) and EA-18G Growler (Electronic Jamming).
Escort Fleet (DESRON 21):
USS Frank E. Petersen Jr. (DDG-121): Acting as Air Defense Commander; conducted live-fire exercises January 23.
USS Spruance (DDG-111): Screening destroyer in the Arabian Sea.
USS Michael Murphy (DDG-112): Part of CSG-3 strike force.
USS Delbert D. Black (DDG-119): Update January 30: Crossed into the Red Sea January 29; positioned near Eilat.
Support: EA-37B Compass Call II (Serial 17-5579) deployed for high-end electronic suppression.
B. Iranian counter-measures
IRIS Shahid Bagheri: Iran’s “Drone Carrier” (C110-4) anchored ~5 km south of Bandar Abbas as of January 27.
IRINS Makran: Forward base ship positioned to support asymmetric drone/missile swarms.
2. Real-time monitoring dashboard
3. Technical identifiers: CSG-3 strike force
Vessels often disable AIS, but their embarked aviation assets (Seahawks/Ospreys) transmit hex codes.
A. Surface combatant identifiers
B. High-interest ICAO Hex codes (CVW-9)
Stealth strike (F-35C):
AE648AthroughAE649F(VMFA-314).Electronic warfare (EA-18G):
AE4E5D,AE4E62(VAQ-133).Carrier early warning (E-2D):
AE5B34,AE5B35,AE5B37(VAW-117).Logistics (CMV-22B):
AE633E,AE634A(The “Mailmen” revealing carrier position).
4. Import ready: Potential target watchlist
Save as a .CSV file and import into Google Earth Pro.
Name,Latitude,Longitude,Description,Category
Natanz_Pickaxe_Mtn,33.7250,51.7250,New southern site (Kolang Gaz La); fortified Jan 2026,Nuclear
Fordow_Plant,34.8842,50.9981,Subterranean enrichment site deep in mountain,Nuclear
Isfahan_UCF,32.6500,51.6667,Uranium Conversion Facility; targeted in June 2025,Nuclear
Mehrabad_Base,35.6892,51.3134,IRGC Air Logistics Hub; F-14 station,Military
Bandar_Abbas,27.0603,56.1282,Naval/Drone Hub; current Shahid Bagheri anchor point,Military
Parchin_Taleghan_2,35.5333,51.7519,Site being encased in concrete "sarcophagus" (Jan 24),Military
Khorramabad_Silos,33.5813,48.1815,Imam Ali Missile Base; underground silo cluster,Military5. Farsi investigative directory (Dorks)
Accidental explosions:
site:irna.ir OR site:farsnews.ir "انفجار" OR "حادثه" after:2026-01-25Air defense drills:
site:isna.ir "رزمایش" OR "تست پدافند" after:2026-01-29GPS/signal disturbance:
intext:"اختلال جیپیاس" OR "سیگنال" site:ict.gov.ir6. Digital forensics and verification
Chronolocation (SunCalc): On January 30, shadows in Tehran must be long and point north-east. Noon solar altitude: ~28.3°.
Keyframe Analysis (InVID & WeVerify): Used to detect recycled footage from the June 2025 “12-Day War.”
Thermal Confirmation: Cross-reference any reports with NASA FIRMS to detect thermal anomalies at nuclear/military coordinates.
A. Primary source intelligence (Social & Messaging)
Telegram monitoring: Utilize TGStat or Telemetr to scrape hyper-local district channels. Focus on “neighbourhood-watch” metadata over state-run narratives.
Censorship circumvention: Cross-reference NetBlocks and Cloudflare Radar to identify regional connectivity drops in cities like Isfahan or Karaj.
Verification of ‘old’ footage: Use Google Lens to fragment video keyframes for reverse-image searching against historical archives.
B. Geospatial verification
Shadow analysis (Chronolocation): Calculate time/date via SunCalc or use PeakVisor to align mountain silhouettes with video backgrounds.
Industrial/nuclear markers: Monitor Natanz and Fordow for geological changes.
Commercial imagery: Access Planet Labs (3m resolution) or Sentinel Hub EO Browser for post-strike burn scars or thermal anomalies.
Below is the specialised JavaScript Evalscript (Version 3) designed for the Sentinel Hub EO Browser. This script isolates high-heat signatures (potential strikes or facility vent surges) and flags physical terrain changes (burn scars or new spoil piles).
// VERSION=3
// Operational ARMADA: Thermal Anomaly & Burn Scar Detector
// Purpose: Identify high-heat vent signatures and structural damage
function setup() {
return {
input: ["B02", "B03", "B04", "B08", "B11", "B12", "dataMask"],
output: { bands: 3 }
};
}
function evaluatePixel(sample) {
// 1. Normalized Burn Ratio (NBR) for surface scarring
let nbr = (sample.B08 - sample.B12) / (sample.B08 + sample.B12);
// 2. SWIR Intensity for Active Heat (B12 & B11)
// These bands are highly sensitive to high-temperature thermal anomalies
let heatIntensity = (sample.B12 + sample.B11) / 2;
// 3. Logic: If SWIR (heat) is high, highlight in vivid RED/ORANGE
// Thresholds calibrated for 2026 winter-arid Iranian desert conditions
if (sample.B12 > 0.4 && sample.B11 > 0.35) {
return [1, 0.2, 0]; // Active Thermal Anomaly (Vivid Orange)
}
// 4. Logic: If NBR is significantly low, color dark BROWN (Fresh Burn/Spoil)
if (nbr < -0.2) {
return [0.4, 0.2, 0.1]; // Surface Scarring
}
// 5. Default: False Color (B12, B11, B04) for structural clarity
// Good for spotting new concrete or excavation patterns
let val = [2.5 * sample.B12, 2.5 * sample.B11, 2.5 * sample.B04];
return val;
}C. Technical lead: Asset tracking
Aviation: Track unlisted military movement via ADS-B Exchange (filtering for “blocked” or “UHB” signals).
Maritime: Monitor “dark” vessels in the Strait of Hormuz using MarineTraffic or VesselFinder.
Bunker buster assessment: Apply the Sandia Penetration Equation to estimate the effectiveness of munitions such as the GBU-57 MOP against Iranian limestone or reinforced concrete.
D. Investigative red flags
Thermal hotspots: Map “gas cylinder explosion” denials against NASA FIRMS (Fire Information for Resource Management System) to confirm high-temperature anomalies at military coordinates.
Official narrative tracking: Compare real-time reports against IRNA (Islamic Republic News Agency) and Fars News to identify “routine drill” patterns.
7. B-Roll & visual verification guide
Priority: Distinguish between current ‘Armada’ manoeuvres and archived footage from the June 2025 12-Day War.
A. High-probability ‘zombie’ footage (Flags)
The following clips are currently circulating on Telegram/X but are NOT from January 30, 2026. Flag these if seen in newsroom feeds:
“Carrier in the Strait”: Footage of a carrier passing a rocky coastline with green vegetation. (Likely 2019/2021 transit; January 2026 conditions are arid/hazy).
“Isfahan explosions”: Night-vision footage showing orange sky-bursts. (Confirmed as June 2025 AD drills over the UCF).
“F-35 launch”: Clips from USS Carl Vinson (CVN-70). (Verify hull number 72 on the flight deck for the Lincoln).
B. OSINT geolocation lead: “The Armada”
If footage emerges of the U.S. fleet from the Iranian coast, use these landmarks for triangulation:
Hormuz Island: Distinctive red soil/cliffs. If visible in the background of Iranian fast-boat footage, the vessel is within 12nm of the coast.
Musandam Peninsula: If Omani mountain peaks are visible to the South, the fleet is in the Strait of Hormuz traffic separation scheme.
Sources
ADS-B Exchange (2026) Aviation tracking and hex code database (Accessed: 30 January 2026).
Bowler, D., Flannery, M. and Aminolahi, M. (2026) ‘How to decode Iranian state media: A field guide for newsrooms and OSINT researchers’, The Agile Newsroom [Substack], 12 January (Accessed: 30 January 2026).
Cloudflare (2026) Cloudflare Radar: Iran Connectivity and Traffic (Accessed: 30 January 2026).
InVID & WeVerify (2026) InVID & WeVerify verification plugin [Software] (Accessed: 30 January 2026).
MarineTraffic (2026) Maritime vessel tracking: Strait of Hormuz (Accessed: 30 January 2026).
NASA FIRMS (2026) Fire Information for Resource Management System: Thermal anomalies Iran (Accessed: 30 January 2026).
NetBlocks (2026) Internet governance and connectivity tracking: Iran (Accessed: 30 January 2026).
Planet Labs (2026) Planet Explorer: High-resolution satellite imagery (Accessed: 30 January 2026).
Sentinel Hub (2026) EO Browser: Multi-spectral satellite monitoring (Accessed: 30 January 2026).
SunCalc (2026) SunCalc: Sunlight phases and shadow analysis for Tehran (Accessed: 30 January 2026).
TGStat (2026) Telegram channel analytics and scraping tool (Accessed: 30 January 2026).