#TrollTracker: An Iranian Messaging Laundromat

Websites repackaged content from Iran’s state channels and passed them on to users

@DFRLab
@DFRLab
Aug 29, 2018 · 8 min read
Logos of the IUVM cluster, on an Iranian flag. (Source for logos: iuvmnews.com. Graphic by @DFRLab)

A cluster of websites known as IUVM (“International Union of Virtual Media”) appears to have been laundering Iranian state messaging by claiming it as their own and passing it on to other users, who reproduce it without showing its ultimate origin, @DFRLab can confirm.

The exposure, reported by Reuters and reviewed by @DFRLab, shows that a network of Iranian inauthentic “news” sites and social media pages taken down last week was part of a larger system, which is still operating.

It is unclear who is behind the system, but the evidence suggests that is linked to the Iranian state. Its purpose appears to be to re-label Iranian state messaging, so that it can passed on to an unsuspecting audience.

A pro-Iran network exposed

“This operation is leveraging a network of inauthentic news sites and clusters of associated accounts across multiple social media platforms to promote political narratives in line with Iranian interests,” FireEye wrote.

The network of suspect Iranian inauthentic sites. (Source: FireEye)

Simultaneously, Facebook announced that it had removed over 600 accounts associated with the network, having found them “inauthentic.”

FireEye and Facebook named a number of websites which they linked to the network, including libertyfrontpress.com, institutomanquehue.org, britishleft.com, RPFront.com, and USjournal.net. As of August 28, those websites were still operating. @DFRLab analyzed the first two sites, which had the clearest ties to Iran via email addresses and phone numbers, here.

Subsequent research revealed that all those sites shared content from another cluster of websites, which repackaged Iranian state messaging without attributing it as such.

The IUVM cluster

Logos of the IUVM cluster. (Source: iuvmnews.com)

Others included iuvmpress.com, which published apparently original articles from a largely pro-Iranian and anti-Western standpoint; iuvmtv.com, a video channel with pronounced anti-U.S. and anti-Saudi leanings; and iuvmpixel.com, which featured similarly anti-U.S. and anti-Saudi cartoons.

Left, screenshot of iuvmtv.com, showing its main topics as of August 28, 2018, when it was archived. Right, screenshot of a cartoon from iuvmpixel.com, also archived on August 28, 2018. Note that the cartoon is watermarked mintpressnews.com. (Source: iuvmtv.com / iuvmpixel.com)

It also included iuvmnews.com, a news aggregator for outlets including Iranian state broadcaster Press TV, Iranian news agency Fars, Russian state broadcaster RT, Venezuelan state broadcaster TeleSur, Syrian pro-regime outlet Al-Masdar, and U.S.-based conspiracy site Veterans Today.

Screenshot of the iuvmnews.com ticker, archived on August 28, 2018. Top to bottom, the sources are Al-Masdar, Press TV, TeleSur, Fars, Mondoweiss, and Veterans Today. (Source: iuvmnews.com)

None of the sites gave a contact address other than by email, or explained the group’s financing. The iuvm.org About page described the process of its launch in 2015, but not its location; the Contact page gave the same text.

The group’s statute, downloadable from iuvm.org, said that its headquarters was in Tehran, and that it drew its budget from “individual donations and fundraisings and through other organizations,” without elaborating.

Screenshot of the IUVM Statute, articles 1–3, showing the location and budget. (Source: iuvm.org)

Some of the language in the statute strongly resembled official Iranian regime rhetoric. For example, it repeatedly referred to the fight against “global arrogance” and the “global arrogance states;” this is the exact phrase used by Iran’s Ayatollah Khamenei in a 2009 geopolitical essay on “global arrogance.”

Top left, essay by Ayatollah Khamenei, reproduced on his official website. Bottom left, the IUVM statute, article 4. Right, enlarged wording of the statute. (Source: khamenei.ir / iuvm.org)

Across the sites, the content was routinely pro-Iranian, pro-Palestinian, anti-American and anti-Israel.

Left to right, cartoon from iuvmpixel.com on U.S. sanctions and Saudi air strikes in Yemen; headline from iuvmpress.com on the Persian Gulf; meme from iuvmarchive.com on the U.S. recognition of Jerusalem as Israel’s capital. All archived on August 28, 2018. (Source: iuvmpixel.com / iuvmpress.com / iuvmarchive.com)

According to online analyst Josh Russell, the IUVM sites were hosted at the same IP address as a website called sayyidali.com, which, in turn, shared infrastructure with other sites in the network exposed by FireEye.

(Source: Twitter / @josh_emerson)

The Tehran location and the geopolitical stance point to this as an Iranian pro-regime operation. The reproduction of Khamenei’s rhetoric, including the key catch-phrase “global arrogance,” suggest it is regime-linked, not merely sympathetic.

Laundering content

For example, the English-language page of institutomanquehue.org listed IUVMPress as an author.

Author page from institutomanquehue.org, showing some of IUVM’s content. Note the focus on Hezbollah and Hamas, and the opposition to ISIS. Archived on August 28, 2018. (Source: institutomanquehue.org)

Website britishleft.com, identified by FireEye as part of the same network, repeatedly attributed its articles to IUVMPress, with the byline “HT IUVMPress” (an online contraction for “hat tip to IUVMPress”).

Google search results for articles on britishleft.com attributed to iuvmpress.com. Note the number of results. (Source: Google)

Website libertyfrontpress.com, which FireEye found to have been registered to an email address linked to Iran, regularly published IUVMPress bylines.

Headers for articles from libertyfrontpress.com, showing the shared byline with IUVMpress. All archived on August 28, 2018. (Source for articles: Libertyfrontpress.com)

While IUVM presented its content as original, it was, in fact, more often taken from other sources. On a few occasions, the copies were overt and attributed, either by text or using the logo, as in these reports from Reuters and Al Jazeera.

Attributed articles on iuvmpress.com, with the attributions highlighted. Archived on August 28, 2018. (Source: iuvmpress.com)

Most copies were not attributed. The most frequent source of such stories, reproduced almost verbatim and without attribution, was Iranian state English-language broadcaster Press TV. In many cases, the IUVMPress variant lacked the Press TV lede, or relocated it.

Left, article on IUVMpress.org. Right, article on Press TV. The red box and yellow boxes indicate identical content. The photos are also identical. Archived on August 28, 2018. (Source: iuvmpress.com / Press TV)
Left, article on IUVMpress.org. Right, article on Press TV. The red box indicates identical content. The photos are also identical. Archived on August 28, 2018. (Source: iuvmpress.com / Press TV)

This copying was rapid and systematic. According to Google searches for articles posted on August 24, iuvmpress.com regularly re-posted Press TV content within two hours of its publication.

Results of Google searches for selected key passages on August 24. In each case, Press TV published a few hours before IUVMPress.com. (Source: Google)

Sometimes, the articles were published in the same hour.

Results of Google searches for selected key passages on August 28. (Source: Google)

Some articles reproduced articles and official announcements from Khamenei’s website.

Left, article from iuvmpress.org. Right, article from Khamenei’s official site. The red box marks identical text. The photos are also identical. Archived on August 24, 2018. (Source: iuvmpress.com / khamenei.ir)

One article reproduced a video from the Ayatollah’s site, using the same headline and video, without further commentary. The only difference was that iuvmpress.com added a still above the video.

Left, video on iuvmpress.com. Right, video on khamenei.ir. Archived on August 24, 2018. (Source: iuvmpress.com / khamenei.ir)

Not all the content came from official channels. This article, for example, replicated one on website rpfront.com, another site identified by FireEye as part of the network. The iuvmpress.com headline appeared to be a shortened version of the rpfront.com one, with different capitalization, suggesting that this was not an automated share.

Left, article on iuvmpress.com, dated August 19, 2018. Right, article on rpfront.com, dated August 16, 2018. Colored boxes indicate identical text. Archived on August 24, 2018. (Source: iuvmpress.com / rpfront.com)

This article reproduced one on the website usjournal.net, again identified by FireEye as part of the network. The headline was different, indicating that this was not an automated share. In both cases, the iuvmpress.com version came some days after the original; a Google search did not turn up earlier results, indicating rpfront.com and usjournal.net as the points of origin.

Left, article on iuvmpress.com, dated August 19, 2018. Right, article on usjournal.net, dated August 13, 2018. Red boxes indicate identical text. The two articles were identical; the illustration above was limited by screen-capture size and clarity. Archived on August 24, 2018. (Source: iuvmpress.com / usjournal.net)

The iuvmpress.com website served as an intermediary between these different sites. For example, on August 20, it reproduced a message to pilgrims from Ayatollah Khamenei’s official wesbite. The same day, website britishleft.com copied the post and attributed it to “IUVMPRESS.”

Screenshots of the articles by khamenei.ir, iuvmpress.com and britishleft.com. Red boxes show the identical text. Magenta arrows show the direction of transmission. The yellow box shows the attribution by britishleft.com to “IUVMPRESS.” All archived on August 22–24, 2018. (Source: khamenei.ir / iuvmpress.com / britishleft.com)

On another occasion, iuvmpress.com took the story on Saudi Arabia banning pilgrims (cited above) from usjournal.net. Once more, britishleft.com ran the story, but attributed to IUVMPress.

Screenshots of the articles by usjournal.net, iuvmpress.com and britishleft.com. Red boxes show the identical text. Magenta arrows show the direction of transmission. The yellow box shows the attribution by britishleft.com to “IUVMPRESS.” All archived on August 22–24, 2018. (Source: usjournal.net / iuvmpress.com / britishleft.com)

The origin of the articles was not always obvious. For example, on May 7, 2017, iuvmpress.com ran an article concerning Britain’s alleged inability to control the Islamic State terrorist group. The same text appeared on the Fars news wire the following day, and was repeated verbatim by institutomanquehue.org on May 10, which attributed it to “IUVM Press.” However, the IUVM version lacked the lede, suggesting that it had been taken from an earlier original; the Manquehue version did not.

Also on May 7, website alwaght.com ran the same story, with the original lede. This suggests that alwaght.com was the source, and that iuvmpress.com amplified it, or that both drew on an original which is no longer extant.

Upper image: articles posted on May 7, 2017, by alwaght.com (left) and iuvmpress.com (right). Lower image, the same article printed by Fars (left) and institutomanquehue.org (right). Yellow boxes show the lede; right boxes give an example of identical content; orange boxes give the date. Note also the Manquehue attribution to IUVMPress. (Source: alwaght.com / iuvmpress.com / farsnews.com / institutomanquehue.org)

As a final example, on August 5, 2017, libertyfrontpress.com posted what appeared to be an original article reporting a speech by Ayatollah Khamenei, in which he urged the West to view Iran as a stabilizing factor in the Middle East. It was repeated by iuvmpress.com on August 6, and also by two sites which regularly shared iuvmpress.com content, nthnews.net and awdnews.com.

Results of Google search for a key phrase from the article, with dates highlighted. The awdnews.com article was dated to August 6, 2017. (Source: Google)

The vector of transmission between these sites is unclear.

Conclusion

iuvmpress.com itself appears to serve as a clearing house for pro-regime content. On some occasions, it served as a source to which other sites could refer. On others, it amplified content from other pro-regime sources, often without attribution.

Repeatedly, it re-posted content from Iranian state outlets, without attribution; on some occasions, that content was then picked up by tertiary sources, which attributed it to iuvmpress.com.

The websites under the IUVM brand therefore appear to be another part of the messaging complex which FireEye first exposed. The identity of their operators is not clear; however, given their content, use of language and emphasis on Iranian state messaging, they should definitely be regarded as a pro-regime network, and may well be regime-linked.


Ben Nimmo is Senior Fellow for Information Defense at the Atlantic Council’s Digital Forensic Research Lab (@DFRLab).

@DFRLab is a non-partisan team dedicated to exposing disinformation in all its forms. Follow along for more from the #DigitalSherlocks.

DFRLab

@AtlanticCouncil’s Digital Forensic Research Lab.

@DFRLab

Written by

@DFRLab

@AtlanticCouncil's Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

DFRLab

DFRLab

@AtlanticCouncil’s Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

@DFRLab

Written by

@DFRLab

@AtlanticCouncil's Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

DFRLab

DFRLab

@AtlanticCouncil’s Digital Forensic Research Lab. Catalyzing a global network of digital forensic researchers, following conflicts in real time.

Welcome to a place where words matter. On Medium, smart voices and original ideas take center stage - with no ads in sight. Watch
Follow all the topics you care about, and we’ll deliver the best stories for you to your homepage and inbox. Explore
Get unlimited access to the best stories on Medium — and support writers while you’re at it. Just $5/month. Upgrade

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store