TOR M-1s that Iran bought from Russia (2007 or so) are a short range area-defense system. They would not have been 'on alert' in the sense people are led to believe because they are not operated as stand-alone systems.


TOR crews don't get to decide anything

A TOR crew outside Tehran would have ZERO authority on their own to target anything they thought was a threat within their TORs 15 km surveillance range. That's just not the way it works in an integrated, layered defense of fixed sites. Someone at the brigade level or above would have been operating medium-range (BUK) and long-range (S-300 or Bavar-373) sites with layered radar coverage. Someone way above the TOR crew's pay grade would have properly identified any threatening target much further away with multiple other radars and handled it appropriately.


Spoofed entire AD network with 'threat'?

Even in an unlikely, hypothetical case, I can't imagine Iran (or any AD forces) clearing a TOR as the sole responder in this scenario, especially for a target 'suddenly appearing' but moving away from Tehran and the airport. What, exactly, would have been the threat to let a point-defense unit to start blasting away?

I also can't imagine a TOR being the first/only one to detect a threatening aircraft even if it was moving directly towards Tehran. Nobody has cloaking devices, and the TOR's little engagement radar has no magical sensitivity that they could have seen anything that all the longer-range radars would have missed. The crews understand this. They're not suppose to make command decisions to destroy aircraft like they're playing a video game, and their commanders would not simply have used the closest TOR to blast an unidentified target near Tehran's airport when they had plenty of time to figure out what was going on and opportunity to blast it if it ever was identified as a threat.


TOR or AD network hacked to fire?

Remotely technically possible, but odd timing/opportunity to give up your secret hack to Iran. I can think of higher value targets to use a one-time trick like that for (if it even exists).


What about the TOR warhead/fuse/pointy-thingy?

The nose and its movable fins are the guidance unit, not a warhead. No fuse, no explosives. The warhead is behind it. As b points out, TOR guidance units have be found where TORs (the 9M331 missile) have detonated. First, Bellingcat said the picture came from the crash site. Then they said from the same neighborhood where the video guy was standing. I'm sure it was wherever MEK thought it was a good idea to toss it. If this 'incriminating' evidence was turned in to authorities, the Iranians will be able to trace it back to the unit that supposedly fired it. Of course, they could just drive out to that TOR site and look for an empty launch tube. I'm guessing they will never retrieve it because MEK doesn't want Iran to know it was last attached to, say, a Cypriot, Egyptian or Azerbaijani TOR M-1.


What about the video? Fake?

If it's real, then I would say a MANPADS. The aircraft was easily within range and engagement envelope of any modern shoulder-fired rocket (or two). Explosive residue and shrapnel will help identify the specific one. The area it would have been fired from is low, rocky hills. Easy to conceal actual launch site minus the sound, but someone would have reported it. All MANPADS solid-fuel motors are really damn loud, so anyone within a few km would have heard it launched and at least seen it after a few seconds.

Easy enough to fake a video like that though, but that's not the most damning evidence against it. I'm having problems with

1) The aircraft stopped transmitting ADS-B (the Flightradar data) too early. Whether it was a MANPADS or TOR, that doesn't explain the gap between the last ADS-B transmission and the supposed missile strike. That's not proof of anything, but it seems odd. Did the aircraft lose electrical power or radios 15 seconds before 'being hit'? Why? Other flights taking off from Tehran kept transmitting every 5-6 seconds, and ground stations 'heard' ADS-B in that area, so it's not coverage.

2) An IR-seeking MANPAD does not discriminate between engines. It goes towards the brightest IR signature it sees, which would be the closest engine. Considering the aircraft's abrupt right turn, it would have been the starboard engine that failed, not the port one on the side the missile came from.

3) The vertical stabilizer (rudder) was torn off the tail just prior to impact and found at the leading edge of the debris field. That's a really, really strong part of the aircraft. Usually you'll find the vertical stabilizer (elevator) wings still attached to the horizontal stabilizer if the aircraft comes apart. For aerodynamic forces to rip that thing off, the aircraft would have to be spinning or encountered some other catastrophic forces just prior to impact. The final tens of seconds seem to have been in a relatively straight line, but I don't know for sure. We haven't seen any radar, and no final-seconds video to see how the aircraft was reacting. The debris field was long and it appears the aircraft didn't hit in a near vertical attitude, so it was 'kind of' flying the last few seconds. That's just an odd time for the vertical stabilizer to come off first considering everything else that was disintegrating. Don't know what to make of that.