Profile picture
Josh Russell @josh_emerson
, 61 tweets, 23 min read Read on Twitter
There are more of these thread.

Suspected Iranian Influence Operation Leverages Network of Inauthentic
News Sites & Social Media Targeting Audiences in U.S., UK, Latin
America, Middle East
fireeye.com/blog/threat-re…
we got 9 urls from FireEye's report.
and I had flagged another 13 back in march.

Mostly due to these reddit users:
/u/Mike_Rubin
/u/AllenDono
/u/finalin
/u/KevanKing
/u/Pazaj
/u/erickiskandar
Most of these sites share OR shared a common host at some point in time.
AS24940 hetzner[.]com
From march:
balkanspost[.]com
ahtribune[.]com
muslimpress[.]com
awdnews[.]com
whatsupic[.]com
mepanorama[.]net
nilenetonline[.]com
raitunisia[.]com
realnienovosti[.]com
nilenetonline[.]com
sayyidali[.]com
7sabah[.]com
libertyfighters[.]uk
While I don't know their IP addresses I do know the sites FireEye identified do sit on hetzner servers.
libertyfrontpress[.]com messed up once.
that gives me 46.4.64.180 to have a look at.

sayyidali[.]com sat on that server as well, it's website is still up.
It looks like most of its social media is still up.
At some point in time sayyidali[.]com was hosted at 5.9.29.230

That address give us a bunch of new sites all with the same theme.
And some (of course russian trash)
iuvmtech[.]com
iuvm[.]org
afghanwolas[.]com
iuvmpress[.]com
mehwarmasr[.]com
iuvm[.]net
iuvmnews[.]com
iuvmnews[.]com
has active social media links.
iuvmtv[.]com
has some suspended social media links and some active
mehwarmasr[.]com
active social media
afghanwolas[.]com
active social media
this iuvmnews[.]com is kinda crazy. it leads to 8 more sites that all have their own social media. And it has RT on the front page.

iuvmpixel[.]com is a meme dump.

iuvm[.]org
iuvmtv[.]com
iuvmonline[.]com
iuvmarchive[.]com
iuvmpress[.]com
iuvmapp[.]com
iuvmtech[.]com
5.9.200.236 here is some pretty damning evidence for all these domains.
institutomanquehue[.]org a FireEye Identified site.
Up to 40+ websites now.
Looks like this all started in 2014
Almost all the sites are exactly that same.
There are probably hundreds? not sure yet.
3adalah[.]com
awdnews[.]com
almasirahtv[.]com
alhiwaraldini[.]com
al-ahd[.]net
ahtribune[.]com
afghanwolas[.]com
afghanistanema[.]com
7sabah[.]com
hshed[.]com
hajez-sy[.]com
farhang-press[.]com
enqazsyria[.]com
dreamofiran[.]com
darinews[.]com
barchinews[.]com
Not going to post them all here but you get the idea. They are almost all the same. Going to finish out with the english language ones.
like:
balkanspost[.]com
awdnews[.]com
and
awdnews[.]org
libertyfighters[.]uk is pretty interesting
muslimpress[.]com
and
moslempress[.]com
why am i so interested in this stuff? because there's some crossover with the russians.

google translate says this site is in Tajik fyi
risolattj[.]com

"news" in meme format, these dudes get it.
realnienovosti[.]com another russian site.
interesting it sits on the same webhost the iranians used

some social media suspended
whatsupic[.]net
whatsupic[.]org
whatsupic[.]com
It's so weird all the same reddit users kept posting links to these obscure websites? right?
reddit.com/domain/whatsup…
reddit.com/domain/7sabah.…
/u/TimWalter2015 posted links to a ru site as well.
slapped these 53 urls into google bigQuery.
got almost 9000 results for reddit posts.
of course reddits Qanon sub is posting links to Iranian propaganda
top 50 subreddits based on those urls going back to i think december 2015
here is the best way I could think of to list all these domains and how they overlap.

Formerly or Currently hosted at IP at the top (w/country), domains hosted at some point under each.

The ones highlighted in red overlap (they shared an IP).

docs.google.com/spreadsheets/d…
wait, this is the best. IF all those domains end up being part of the original fireeye network of Iranian influence network.
this site tops them all "hindi news india"
hindkhabar[.]com
hosted in Pakistan at one point.
has active social media.
google sheet with some initial reddit results, both expanded for new domains and a few dropped that didn't seem like part of this.
sorted by created_utc
docs.google.com/spreadsheets/d…
spreadsheet with clickable links to some of the twitter accounts associated with these websites.
10 already suspended and 27 live accounts.
docs.google.com/spreadsheets/d…
Twitter list format as well:
twitter.com/josh_emerson/l…
For those 10 suspended accounts there is still some cache info out there
going to try to save as much as i can
More samples:
.@realnienovosti1 the russian one samples
found another suspect site with social media
pakonlinenews[.]com
facebook.com/PakOnlineNewsO…<--- gone
Instagram and twitter still live
I have updated this spreadsheet.
Dropped a few pre-2014 accounts, added a few new ones.
Pulled a 3200 tweet timeline for each account.
Pulled the friends and followers for each account.
The timeline friends and followers are on tabs at the bottom.
docs.google.com/spreadsheets/d…
the 1st thing you will notice?
bots.

checking followers, dropping duplicates, sorted by created date:
Just looking at AHTribune's followers.
1000+ recently created bot accounts.
Missing some Tweet in this thread?
You can try to force a refresh.

Like this thread? Get email updates or save it to PDF!

Subscribe to Josh Russell
Profile picture

Get real-time email alerts when new unrolls are available from this author!

This content may be removed anytime!

Twitter may remove this content at anytime, convert is as a PDF, save and print for later use!

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member and get exclusive features!

Premium member ($30.00/year)

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!

Did Thread Reader help you today?

Support us! We are indie developers!


This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member and get exclusive features!

Premium member ($30.00/year)

Too expensive? Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal Become our Patreon

Thank you for your support!