#TrollTracker: An Iranian Messaging Laundromat

Websites repackaged content from Iran’s state channels and passed them on to users

Logos of the IUVM cluster, on an Iranian flag. (Source for logos: iuvmnews.com. Graphic by @DFRLab)

A cluster of websites known as IUVM (“International Union of Virtual Media”) appears to have been laundering Iranian state messaging by claiming it as their own and passing it on to other users, who reproduce it without showing its ultimate origin, @DFRLab can confirm.

The exposure, reported by Reuters and reviewed by @DFRLab, shows that a network of Iranian inauthentic “news” sites and social media pages taken down last week was part of a larger system, which is still operating.

It is unclear who is behind the system, but the evidence suggests that is linked to the Iranian state. Its purpose appears to be to re-label Iranian state messaging, so that it can passed on to an unsuspecting audience.

A pro-Iran network exposed

On August 21, online research team FireEye published a report exposing a network of apparently independent websites and social media accounts which were linked, by their registration emails and phone numbers, to Iran.

“This operation is leveraging a network of inauthentic news sites and clusters of associated accounts across multiple social media platforms to promote political narratives in line with Iranian interests,” FireEye wrote.

The network of suspect Iranian inauthentic sites. (Source: FireEye)

Simultaneously, Facebook announced that it had removed over 600 accounts associated with the network, having found them “inauthentic.”

FireEye and Facebook named a number of websites which they linked to the network, including libertyfrontpress.com, institutomanquehue.org, britishleft.com, RPFront.com, and USjournal.net. As of August 28, those websites were still operating. @DFRLab analyzed the first two sites, which had the clearest ties to Iran via email addresses and phone numbers, here.

Subsequent research revealed that all those sites shared content from another cluster of websites, which repackaged Iranian state messaging without attributing it as such.

The IUVM cluster

The cluster called itself the “International Union of Virtual Media,” or IUVM. As of August 28, 2018, it numbered at least ten websites. The “official” page was iuvm.org, which described the group’s goals, including “Confronting with remarkable arrogance, western governments and Zionism front activities to correct the deflection of people movements in world.”

Logos of the IUVM cluster. (Source: iuvmnews.com)

Others included iuvmpress.com, which published apparently original articles from a largely pro-Iranian and anti-Western standpoint; iuvmtv.com, a video channel with pronounced anti-U.S. and anti-Saudi leanings; and iuvmpixel.com, which featured similarly anti-U.S. and anti-Saudi cartoons.

Left, screenshot of iuvmtv.com, showing its main topics as of August 28, 2018, when it was archived. Right, screenshot of a cartoon from iuvmpixel.com, also archived on August 28, 2018. Note that the cartoon is watermarked mintpressnews.com. (Source: iuvmtv.com / iuvmpixel.com)

It also included iuvmnews.com, a news aggregator for outlets including Iranian state broadcaster Press TV, Iranian news agency Fars, Russian state broadcaster RT, Venezuelan state broadcaster TeleSur, Syrian pro-regime outlet Al-Masdar, and U.S.-based conspiracy site Veterans Today.

Screenshot of the iuvmnews.com ticker, archived on August 28, 2018. Top to bottom, the sources are Al-Masdar, Press TV, TeleSur, Fars, Mondoweiss, and Veterans Today. (Source: iuvmnews.com)

None of the sites gave a contact address other than by email, or explained the group’s financing. The iuvm.org About page described the process of its launch in 2015, but not its location; the Contact page gave the same text.

The group’s statute, downloadable from iuvm.org, said that its headquarters was in Tehran, and that it drew its budget from “individual donations and fundraisings and through other organizations,” without elaborating.

Screenshot of the IUVM Statute, articles 1–3, showing the location and budget. (Source: iuvm.org)

Some of the language in the statute strongly resembled official Iranian regime rhetoric. For example, it repeatedly referred to the fight against “global arrogance” and the “global arrogance states;” this is the exact phrase used by Iran’s Ayatollah Khamenei in a 2009 geopolitical essay on “global arrogance.”

Top left, essay by Ayatollah Khamenei, reproduced on his official website. Bottom left, the IUVM statute, article 4. Right, enlarged wording of the statute. (Source: khamenei.ir / iuvm.org)

Across the sites, the content was routinely pro-Iranian, pro-Palestinian, anti-American and anti-Israel.

Left to right, cartoon from iuvmpixel.com on U.S. sanctions and Saudi air strikes in Yemen; headline from iuvmpress.com on the Persian Gulf; meme from iuvmarchive.com on the U.S. recognition of Jerusalem as Israel’s capital. All archived on August 28, 2018. (Source: iuvmpixel.com / iuvmpress.com / iuvmarchive.com)

According to online analyst Josh Russell, the IUVM sites were hosted at the same IP address as a website called sayyidali.com, which, in turn, shared infrastructure with other sites in the network exposed by FireEye.

(Source: Twitter / @josh_emerson)

The Tehran location and the geopolitical stance point to this as an Iranian pro-regime operation. The reproduction of Khamenei’s rhetoric, including the key catch-phrase “global arrogance,” suggest it is regime-linked, not merely sympathetic.

Laundering content

The most significant of the pages, in terms of content laundering, was iuvmpress.com. All of the websites identified by FireEye re-posted its content, naming it as their source, on a wide range of issues.

For example, the English-language page of institutomanquehue.org listed IUVMPress as an author.

Author page from institutomanquehue.org, showing some of IUVM’s content. Note the focus on Hezbollah and Hamas, and the opposition to ISIS. Archived on August 28, 2018. (Source: institutomanquehue.org)

Website britishleft.com, identified by FireEye as part of the same network, repeatedly attributed its articles to IUVMPress, with the byline “HT IUVMPress” (an online contraction for “hat tip to IUVMPress”).

Google search results for articles on britishleft.com attributed to iuvmpress.com. Note the number of results. (Source: Google)

Website libertyfrontpress.com, which FireEye found to have been registered to an email address linked to Iran, regularly published IUVMPress bylines.

Headers for articles from libertyfrontpress.com, showing the shared byline with IUVMpress. All archived on August 28, 2018. (Source for articles: Libertyfrontpress.com)

While IUVM presented its content as original, it was, in fact, more often taken from other sources. On a few occasions, the copies were overt and attributed, either by text or using the logo, as in these reports from Reuters and Al Jazeera.

Attributed articles on iuvmpress.com, with the attributions highlighted. Archived on August 28, 2018. (Source: iuvmpress.com)

Most copies were not attributed. The most frequent source of such stories, reproduced almost verbatim and without attribution, was Iranian state English-language broadcaster Press TV. In many cases, the IUVMPress variant lacked the Press TV lede, or relocated it.

Left, article on IUVMpress.org. Right, article on Press TV. The red box and yellow boxes indicate identical content. The photos are also identical. Archived on August 28, 2018. (Source: iuvmpress.com / Press TV)
Left, article on IUVMpress.org. Right, article on Press TV. The red box indicates identical content. The photos are also identical. Archived on August 28, 2018. (Source: iuvmpress.com / Press TV)

This copying was rapid and systematic. According to Google searches for articles posted on August 24, iuvmpress.com regularly re-posted Press TV content within two hours of its publication.

Results of Google searches for selected key passages on August 24. In each case, Press TV published a few hours before IUVMPress.com. (Source: Google)

Sometimes, the articles were published in the same hour.

Results of Google searches for selected key passages on August 28. (Source: Google)

Some articles reproduced articles and official announcements from Khamenei’s website.

Left, article from iuvmpress.org. Right, article from Khamenei’s official site. The red box marks identical text. The photos are also identical. Archived on August 24, 2018. (Source: iuvmpress.com / khamenei.ir)

One article reproduced a video from the Ayatollah’s site, using the same headline and video, without further commentary. The only difference was that iuvmpress.com added a still above the video.

Left, video on iuvmpress.com. Right, video on khamenei.ir. Archived on August 24, 2018. (Source: iuvmpress.com / khamenei.ir)

Not all the content came from official channels. This article, for example, replicated one on website rpfront.com, another site identified by FireEye as part of the network. The iuvmpress.com headline appeared to be a shortened version of the rpfront.com one, with different capitalization, suggesting that this was not an automated share.

Left, article on iuvmpress.com, dated August 19, 2018. Right, article on rpfront.com, dated August 16, 2018. Colored boxes indicate identical text. Archived on August 24, 2018. (Source: iuvmpress.com / rpfront.com)

This article reproduced one on the website usjournal.net, again identified by FireEye as part of the network. The headline was different, indicating that this was not an automated share. In both cases, the iuvmpress.com version came some days after the original; a Google search did not turn up earlier results, indicating rpfront.com and usjournal.net as the points of origin.

Left, article on iuvmpress.com, dated August 19, 2018. Right, article on usjournal.net, dated August 13, 2018. Red boxes indicate identical text. The two articles were identical; the illustration above was limited by screen-capture size and clarity. Archived on August 24, 2018. (Source: iuvmpress.com / usjournal.net)

The iuvmpress.com website served as an intermediary between these different sites. For example, on August 20, it reproduced a message to pilgrims from Ayatollah Khamenei’s official wesbite. The same day, website britishleft.com copied the post and attributed it to “IUVMPRESS.”

Screenshots of the articles by khamenei.ir, iuvmpress.com and britishleft.com. Red boxes show the identical text. Magenta arrows show the direction of transmission. The yellow box shows the attribution by britishleft.com to “IUVMPRESS.” All archived on August 22–24, 2018. (Source: khamenei.ir / iuvmpress.com / britishleft.com)

On another occasion, iuvmpress.com took the story on Saudi Arabia banning pilgrims (cited above) from usjournal.net. Once more, britishleft.com ran the story, but attributed to IUVMPress.

Screenshots of the articles by usjournal.net, iuvmpress.com and britishleft.com. Red boxes show the identical text. Magenta arrows show the direction of transmission. The yellow box shows the attribution by britishleft.com to “IUVMPRESS.” All archived on August 22–24, 2018. (Source: usjournal.net / iuvmpress.com / britishleft.com)

The origin of the articles was not always obvious. For example, on May 7, 2017, iuvmpress.com ran an article concerning Britain’s alleged inability to control the Islamic State terrorist group. The same text appeared on the Fars news wire the following day, and was repeated verbatim by institutomanquehue.org on May 10, which attributed it to “IUVM Press.” However, the IUVM version lacked the lede, suggesting that it had been taken from an earlier original; the Manquehue version did not.

Also on May 7, website alwaght.com ran the same story, with the original lede. This suggests that alwaght.com was the source, and that iuvmpress.com amplified it, or that both drew on an original which is no longer extant.

Upper image: articles posted on May 7, 2017, by alwaght.com (left) and iuvmpress.com (right). Lower image, the same article printed by Fars (left) and institutomanquehue.org (right). Yellow boxes show the lede; right boxes give an example of identical content; orange boxes give the date. Note also the Manquehue attribution to IUVMPress. (Source: alwaght.com / iuvmpress.com / farsnews.com / institutomanquehue.org)

As a final example, on August 5, 2017, libertyfrontpress.com posted what appeared to be an original article reporting a speech by Ayatollah Khamenei, in which he urged the West to view Iran as a stabilizing factor in the Middle East. It was repeated by iuvmpress.com on August 6, and also by two sites which regularly shared iuvmpress.com content, nthnews.net and awdnews.com.

Results of Google search for a key phrase from the article, with dates highlighted. The awdnews.com article was dated to August 6, 2017. (Source: Google)

The vector of transmission between these sites is unclear.

Conclusion

The cluster of sites under the IUVM brand, and especially IUVMPress.com, sit at the center of a network of sites which routinely post content favorable to the Iranian regime. Some are state outlets, such as Press TV and the Ayatollah’s website. Others have no ostensible link to the Iranian state.

iuvmpress.com itself appears to serve as a clearing house for pro-regime content. On some occasions, it served as a source to which other sites could refer. On others, it amplified content from other pro-regime sources, often without attribution.

Repeatedly, it re-posted content from Iranian state outlets, without attribution; on some occasions, that content was then picked up by tertiary sources, which attributed it to iuvmpress.com.

The websites under the IUVM brand therefore appear to be another part of the messaging complex which FireEye first exposed. The identity of their operators is not clear; however, given their content, use of language and emphasis on Iranian state messaging, they should definitely be regarded as a pro-regime network, and may well be regime-linked.


Ben Nimmo is Senior Fellow for Information Defense at the Atlantic Council’s Digital Forensic Research Lab (@DFRLab).

@DFRLab is a non-partisan team dedicated to exposing disinformation in all its forms. Follow along for more from the #DigitalSherlocks.