Thread by @benimmo

Thread: analysing content on the Iran-linked websites which @FireEye exposed last week, h/t @LeeFosterIntel.

Triangulated identification was based on registrant emails, Iranian phone nos for Twitter accounts, and content.

medium.com/dfrlab/trolltr…

Here's Instituto Manquehue, ostensibly a Latin American think tank, reporting a Morales attack on US SecDef Mattis' visit to the region.

The LatAm subject is understandable, but the language is identical with Iranian state outlet HispanTV, writing two days before.

Here's the same "institute", lifting verbatim a HispanTV piece quoting Ayatollah Khamenei on US policy towards Muslims.

It wasn't all HispanTV. Here's a copy of a post from Voltairenet on Israel's plans in Argentina. Original, December 2017. Manquehue version on the "Zionist conquest of Patagonia", June 2018.

This one appeared mostly original. Google search for the top paragraphs didn't return hits...

(Note the topic fits Iranian foreign-policy narratives, inter alia.)

... but it contained a paragraph of what looks like stock HispanTV language on relations between Saudi and Israel.

(HispanTV quotes January and July 2018. Manquehue quote August 2018.)

Of the eight "latest" stories on the English version of the site, only one concerned Latin America, and that was about Messi.

(Note that the site stopped posting in May 2017.)

The other main site identified was LibertyFrontPress.

A lot of its content came from genuine news sources, such as @Independent.

(Note the Israel / Palestine theme.)

Some came from the pro-Assad / pro-Kremlin fringe, such as Globalisation.

(Eyeroll)

This one took excerpts from an interview with Assad, and headlined it with his comments on Iran.

Very clear local interest there.

This one looked written in original English.

So original it was barely comprehensible, in fact.

Reporting Saudi "defeat" in Hodeidah. Two days later, Saudi forces took the airport there.

On social media, the tone was aligned with Iranian foreign policy, inter alia.

This was the Manquehue Spanish Twitter feed. Pro-Iran, anti-US, anti-Israel.

This was Manquehue on Facebook. Cholera in Yemen, Israeli violence, Israel "colonising territories in Africa and Latin America."

On Instagram, interestingly, the Manquehue feed pointed people to its own website, but systematically used HispanTV wordings.

Almost as if its job were to promote HispanTV without admitting it.

LibertyFrontOrg didn't post much Iran-relevant content, at least on the remaining Google cache.

This was one of the few.

Much more of its content was anti-Trump, picking up memes from elsewhere online.

That's something the Russian troll farm did too. It's an easy way to hide.

And, as @FireEye pointed out, here's where it changed its name from @LibertyFrontPR to @Berniecratss.

Targeting a community which was also heavily targeted by Russian trolls in 2016.

It kept the same rough mix of anti-Trump and pro-Iran posts. This doesn't look like the primary goal was to divide Americans, but to get them to pick up on pro-Iran messaging.

This was an exception: a call for a demonstration to impeach Trump.

On balance, this looks like camouflage colouring, rather than a systematic attempt to trigger real-life confrontations.

Upsum 1:

The "Latin American" think tank largely reposted Iranian state content, without attribution. Latin America wasn't its focus.

LibertyFrontPress posted authored pro-Iran / anti-Saudi content, and reposted other outlets.

Upsum 2:

The social media feeds presented themselves as left / progressive groups.

They promoted Iranian state messaging.

This looked like attempts to pass messaging into opposition groups, not to generate real-life action.

America was not the only target.

Upsum 3:

That's five separate online influence ops:
- Russian troll farm 1 (2014-17)
- GRU 1 (Fancy Bear + trolls, 2016)
- Russian troll farm 2 (probable; 2017-18)
- GRU 2 (Microsoft takedown)
- Iran

There will be more. Welcome to our world.

/Thread ends.