Thread by @SlickRockWeb

Remember some of these headlines back in May? This is a fascinating BREAKING article in the Wall Street Journal about a service called Mixi(.)media. There a number of companies that do this where its not clear who the primary news source is #osint

https://twitter.com/asharma/status/1313844493335101440

We came across Mixi(.)media back in May when we were looking at #covid19 disinformation and looked at some of the odd Twitter accounts that were pushing the mixi(.)media stuff. #osint

This service like a number of others like it actually obscure who the true source behind the news banner is. Here are a few banner ad titles the Mixi(.)media redirect link and the final landing source. #osint

Even more interesting are all the connections that Mix(.)media has to Russian infrastructure & Russian owned websites that share dedicated IPs with Mixi(.)media. The WSJ article mentions this as well. Using the great #osint tools from @RiskIQ u can quickly find these connections

For those not familiar an SPF record is something the domain owner purposefully sets 2 allow other infrastructure 2 send & receive mail without being flagged as spam. In this case the owner of Mixi(.)media added the Russian IP of 46.4.151(.)167 as an SPF. This is not accidental

And the connections certainly don't end at the SPF record as a little digging with @riskiq @PassiveTotal #osint tools will quickly reveal.