Website Nile Net Online promises Egyptians "true news" from its offices in the heart of Cairo's Tahrir Square, with the aim of expanding "the scope of freedom of expression in the Arab world."
Its views on America do not align with those of Egypt's state media, which consistently celebrates U.S. President Donald Trump's warm relations with Cairo. In one recent article, Nile Net Online derided the American president as a "low-level theater actor," who "turned America into a laughing stock" when he attacked Iran in a speech at the United Nations.
Until recently, Nile Net Online had more than 115,000 followers across Facebook, Twitter and Instagram. But its contact telephone numbers, including one listed as 0123456789, don't work. A Facebook map showing its offices' location features a pin in the middle of the street, rather than on any building. Regulars at the square, including a newspaper stallholder and a policeman, say they have never heard of the website.
The reason: Nile Net Online is part of an influence operation based in Tehran.
It's one of more than 70 websites found by Reuters to be promoting Iranian propaganda in 15 countries, in an operation that cybersecurity experts, social media firms and journalists are only now starting to uncover. The sites, which are visited by more than half a million people every month, have been propped up by social media accounts with over a million followers.
The sites reveal how political actors worldwide are increasingly circulating distorted or false information online to influence public opinion. The discoveries follow allegations that Russian disinformation campaigns swayed voters in the United States and Europe.
Myanmar's military and advisers to Saudi Arabia's crown prince are also among those using social media to distribute propaganda and attack their enemies. Moscow has denied the charges; Saudi Arabia and Myanmar have declined to comment on them.
Former CIA Director John Brennan told Reuters that "countries around the globe" are now using such information warfare tactics.
"The Iranians are sophisticated cyber players," he said of the Iranian campaign. "There are elements of the Iranian intelligence services that are rather capable in terms of operating [online]."
Traced using research from cybersecurity firms FireEye and ClearSky, the sites in the campaign have been active at various times since 2012. While they look like normal news and media outlets, a couple of the sites disclose Iranian ties.
Reuters could not determine whether the Iranian government was behind the sites; Iranian officials in Tehran and London did not reply to questions.
But all the sites are linked to Iran in one of two ways: Some carry stories, videos and cartoons supplied by an online agency called the International Union of Virtual Media, which according to its website is headquartered in Tehran. Others have shared online registration details with IUVM, such as addresses and phone numbers. In total, 21 of the websites do both.
Emails sent to IUVM bounced back and telephone numbers the agency provided in its web registration records did not work. Documents available on the main IUVM website say its objectives include "confronting remarkable arrogance, Western governments and Zionism front activities."
Nile Net Online did not respond to questions sent to the email address on its website. Its operators, as well as those of the other websites identified by Reuters, could not be located. Previous owners identified in historical registration records could not be reached. The Egyptian government did not respond to requests for comment.
Some of the sites in the Iranian operation were first exposed in August by companies including Facebook, Twitter and Google's parent company, Alphabet, after they were discovered by FireEye. The social media companies have closed hundreds of accounts that promoted the sites or pushed Iranian messaging. Facebook said last month it had taken down 82 pages, groups and accounts linked to the Iranian campaign, which had garnered over one million followers in the U.S. and Britain.
But the sites uncovered by Reuters have a much wider scope. Operating in 16 different languages, from Azerbaijani to Urdu, they target internet users in less developed countries. The fact that they have reached people in such tightly controlled societies as Egypt, which has blocked hundreds of news websites since 2017, highlights the campaign's reach and efficacy.
The Iranian sites include:
• A news site called Another Western Dawn which purports to focus on "unspoken truth." The site fooled the Pakistani defense minister into issuing a nuclear threat against Israel.
• Ten outlets targeting readers in Yemen, where Iran and U.S. ally Saudi Arabia have been fighting a proxy conflict since civil war broke out there in 2015.
• A media outlet offering daily news and satirical cartoons in Sudan that could not be reached by Reuters.
• A website in Russian called Realnie Novosti, or "Real News" that offers a downloadable mobile phone app – its operator could not be traced.
But it's not all fake news on these sites, in which authentic stories appear alongside pirated cartoon and speeches from Iran's Supreme Leader Ayatollah Ali Khamenei. The sites clearly support Iran's government and amplify antagonism toward countries opposed to Tehran – particularly Israel, Saudi Arabia and the U.S. Nile Net's "laughing stock" piece was copied from an Iranian state TV network article published earlier the same day.
Some of the sites are slapdash. The self-styled, misspelled "Yemen Press Agecny" carries a running update of Saudi "crimes against Yemenis during the past 24 hours." Emails sent to the agency's listed contact, Arafat Shoroh, bounced back. The agency's address and phone number led to a hotel in the Yemeni capital, Sanaa, whose staff said they had never heard of Shoroh.
The identity or location of the past owners of some of the websites is visible in historical internet registration records: 17 of 71 sites have in the past listed their locations as Iran or Tehran or provided an Iranian telephone or fax number. But information as to their current owner is often hidden, and none of the Iranian-linked operators could be reached.
More than 50 of the sites use American web service providers Cloudflare and OnlineNIC, which provide website owners tools to shield themselves from spam and hackers. Such services often also serve to effectively conceal who owns the sites or where they are hosted. Cloudflare and OnlineNIC both declined to tell Reuters who operates the sites.
Under U.S law, hosting and web service companies are not generally liable for the content of sites they serve, according to Eric Goldman, co-director of Santa Clara University's High Tech Law Institute. Still, since 2014, U.S. sanctions on Iran have banned "the exportation or re-exportation, directly or indirectly, of web-hosting services that are for commercial endeavors or of domain name registration services."
Douglas Kramer, general counsel for Cloudflare, said the services it provides do not include web-hosting services. "We've looked at those various sanctions regimes, we are comfortable that we are not in violation," he said.
A spokesman for OnlineNIC said none of the sites declared a connection to Iran in their registration details, and the company was in full compliance with U.S. sanctions and trade embargoes.
The U.S. Treasury's Office of Foreign Assets Control declined to comment on whether it planned to open an investigation into the matter.
The Kremlin is widely seen as the superpower in modern information warfare. From what is known so far, Russia's influence operation - which Moscow denies – dwarfs Iran's. According to Twitter, nearly 4,000 accounts connected to the Russian campaign posted over 9 million tweets between 2013 and 2018, against over 1 million tweets from fewer than 1,000 accounts believed to originate in Iran.
Even though the Iranian operation is smaller, it has had an impact on volatile topics. AWDnews, the site purporting to focus on "unspoken truth," ran a false story in 2016 that prompted Pakistan's defense minister to warn on Twitter that he had the weapons to nuke Israel. It was only when he was contacted by Reuters that he learned the hoax had been part of an Iranian operation.
"It was a learning experience," said the deceived politician, 69-year-old Khawaja Asif, who left Pakistan's government earlier this year. "But one can understand that these sorts of things happen because fake news has become something huge. It's something anyone is capable of now, which is very dangerous."
Israeli officials did not respond to a request for comment.
The bogus report claimed that "Defense Minister Moshe Ya'alon," who had left the position at the time, said: "If Pakistan sends ground troops into Syria on any pretext, we will destroy this country with a nuclear attack."
Following the AWDnews report, Pakistani Defense Minister Khawaja Asif tweeted, "Israeli def min threatens nuclear retaliation presuming Pak role in Syria against Daesh [ISIS]. Israel forgets Pakistan is a nuclear state too."
The Israeli Defense Ministry responded with two tweets of its own, stressing the AWDnews report was fictitious: "The statement attributed to fmr Def Min Yaalon re Pakistan was never said," and "Reports referred to by the Pakistani Def Min are entirely false."
AWDnews publishes in English, French, Spanish and German and, according to data from web analytics company SimilarWeb, receives around 12,000 unique visitors a month. Among those who have shared stories from AWDnews and the other websites identified by Reuters were politicians in Britain, Jordan, India, and the Netherlands; human rights activists; an Indian music composer and a Japanese rap star.
FireEye originally named six websites as part of the Iranian influence operation. After examining those sites, Reuters learned their content led to the Tehran-based IUVM.
IUVM is an array of 11 websites with names such as iuvmpress, iuvmapp and iuvmpixel. Together, they form a library of digital material, including mobile phone apps, items from Iranian state media and pictures, video clips and stories from elsewhere on the web that support Tehran's policies.
Tracking usage of IUVM content across the internet led to sites that have used its material, registration details, or both. For instance, 22 of the sites have shared the same phone number, which has also been listed for IUVM and which does not work. At least seven sites have used the same address, which belongs to a youth hostel in Berlin. Staff at the hostel told Reuters they had never heard of the sites in question. The site operators could not be reached to explain their links with IUVM.
Two sites even posted job advertisements for IUVM, which said it was seeking women with the "ability to work effectively and with knowledge in dealing with social networks and [the] internet."
One of IUVM's most popular users is a site called Sudan Today, which SimilarWeb data shows receives almost 150,000 unique visitors each month. On Facebook, its 57,000 followers are informed Sudan Today operates without political bias. Its 18,000 followers on Twitter have included the Italian Embassy in Sudan, and its work has been cited in a report by the Egyptian Electricity Ministry.
The office address registered for Sudan Today in 2016 covers a whole city district in north Khartoum, according to archived website registration details provided by WhoisAPI Inc and DomainTools LLC. The phone number listed in those records does not work.
Reuters could not trace staff members named on Sudan Today's Facebook page. The five-star Corinthia Hotel in central Khartoum, where the site says it hosted an anniversary party last year, told Reuters no such event took place and an address listed on one of its social media accounts is a demolished home.
Sudan used to be an Iranian ally but has since aligned itself with Saudi Arabia, costing Tehran a foothold in the Horn of Africa just as it becomes more isolated by the West. It is against this background that Iran sees itself as competing with Israel, Saudi Arabia and the United States for international support, and is acting to take the fight online, said Ariane Tabatabai, a senior associate and Iran expert at the D.C.-based Center for Strategic and International Studies.
Headlines on Sudan Today's homepage include a daily round-up of stories from local newspapers and Ugandan soccer results. It also features reports on the price of bread, which doubled in January after Khartoum eliminated subsidies, triggering demonstrations.
Ohad Zaidenberg, senior researcher at Israeli cybersecurity firm ClearSky, said this mixture of content provides the cover for narratives geared at influencing a target audience's attitudes and perceptions.
The site also draws attention to Saudi Arabia's military actions in Yemen. Since Sudanese President Omar al-Bashir ended his allegiance with Iran, he has sent troops and jets to join Saudi-led forces in the Yemeni conflict.
One cartoon from IUVM published by Sudan Today in August shows Trump astride a military jet with an overflowing bag of dollar bills tucked under one arm. The jet, draped in traditional Saudi dress, is shown dropping bombs on a bloodstained map of Yemen littered with children's toys and shoes.
Turkish cartoonist Mikail Çiftçi drew the original and told Reuters he did not give Sudan Today permission to use his cartoon.
Alnagi Albashra, a 28-year-old software developer in Khartoum, said he likes to read articles on Sudan Today in the evenings while waiting for his baby to fall asleep. But he and three other Sudan Today readers reached by Reuters had no idea who was behind the site.
"This is a big problem," he said. "You can't see that they are not in Sudan."
Government officials in Khartoum, the White House, the Italian Embassy and the Egyptian Electricity Ministry did not respond to requests for comment.
It is unclear who is responsible for responding to online disinformation campaigns like Iran's, or what if any action they should take, said David Conrad, chief technology officer at ICANN, a non-profit that helps manage global web addresses.
Social media accounts can be deleted in bulk by the firms that provide the platforms. But the Iranian campaign's backbone of websites makes it harder to dismantle than social media because taking down a website often requires the cooperation of law enforcement, internet service providers and web infrastructure companies.
Efforts by social media companies in the U.S. and Europe to tackle the campaign have had mixed results.
Shortly after being contacted by Reuters, Twitter suspended the accounts for Nile Net Online and Sudan Today. "Clear attribution is very difficult," a spokeswoman said, but added that the company would continue to update a public database of tweets and accounts linked to state-backed information operations when it had new information.
Google did not respond directly to questions about the websites. The company has said it identified and closed 99 accounts that it says are linked to Iranian state media. "We've invested in robust systems to identify influence operations launched by foreign governments," a spokeswoman said.
Facebook said it was aware of the websites and had removed five more Facebook pages. But a spokesman said that based on company user data, the company was not yet able to link all the websites' accounts to the Iranian activity found earlier. "In the past several months, we have removed hundreds of pages, groups and accounts linked to Iranian actors engaging in coordinated inauthentic behavior. We continue to remove accounts across our services and in all relevant languages," he said.
Accounts linked to the Iranian sites remain active online, especially in languages other than English. Last week, 16 of the Iranian sites were still posting daily updates to Facebook, Twitter, Instagram or YouTube – including Sudan Today and Nile Net Online. Between them, the social media accounts had more than 700,000 followers.
