Esfandyar Batmanghelidj Profile picture
Aug 22, 2018 30 tweets 13 min read Twitter logo Read on Twitter
1. A couple things that stick out about @FireEye's announcement regarding the discovery of an Iranian “influence operation” across websites, Facebook, and Twitter. This doesn't look like an Internet Research Agency type operation.…
2. Let’s start with one of the primary websites identified as part of the network. Instituto Manquehue. You can check it out here:
3. It is a weird site that is clearly trying to look legitimate. But it doesn’t seem inherently “fake.” The institute appears to have been around since 2014 offering a leftist vision for Latin American journalism free from the “foreign influences of West and East.”
4. There is a lot of content there. Some of it obviously cribbed from elsewhere. But the site seems actively managed. There is a pro-Iran, anti-Saudi slant to the coverage of the Middle East--something FireEye points to. But overall content strikes me as in the style of Alternet.
5. What is most interesting, however, is that there is a physical institute in Santiago, Chile of the same name. The signage matches the “Instituto Manquehue of Estudios Estratégicos” veribage on the website and includes a little Facebook logo which is sort of useless now…
6. It would be extreme for an “influence operation” to go so far as to create a physical site in Latin America... and the physical site has existed since Oct. 2014. That is when the street view photo was taken.
7. Iran has been politically active in Latin America, overtly and covertly, especially between 2005-2013. But this institute seems innocuous. Here is a video slideshow of the institute’s first “graduating class” dated to 2013:
8. So the institute is more than a website and can be shown to exist four years ago, well before “social media-driven influence operations” became a major concern for the voting public. The question is how far back does the Iran link go?
9. Well, FireEye’s network map indicates that shares a “registrant email address” with, which shares one with (defunct), which shares one with
10. was registered by an organization called “Persian Domain Provider” on 27/8/2014. The person and email associated with Persian Domain Provider is Kaveh Khaleghi ( The Turkish address appears made-up.
11. As an (amazing) aside, Persian Domain Provider was mentioned in a July 2017 flame war between some Russians debating about Syria on a gun forum. Someone pointed out that the source a poster was using was "fake news" and pulled up the WHOIS record.…
12. So what is the connection between and Well the registrar name for Persian Domain Provider on the record is given as “Stituto Manquehue,” with the typo, which is just weird.
13. This is the case for 4 other domains registered in 2014. But the other 4 (defunct) domains do *not* have Persian Domain Provider as the org. Of these one was registered by “Arab Domain Provider,” which has registered 28 domains. Most seem to be active Arabic news sites.
14. Notably, Arab Domain Provider took over from “Stituto Manquehue” in 2016. Until then the name server for was in Iran. The name server isn't Iranian for or
15. FireEye claim a connection through the registrant and “advertisements for website designers in Tehran" but don't give names. @craigtimberg/@lizzadwoskin cite Facebook on connections as far back as 2011 and links to Press TV.…
16. Press TV and the date 2011 sticks out to me. There are a couple of things to consider. Press TV is Iran’s English-language state media. It is does not conduct proper journalism. It peddles a political line. In that way, it is similar to Russia’s RT.
17. Press TV was established in 2007. It tried very hard to gain traction among Western viewers. Case in point: Labour Leader Jeremy Corbyn appeared on Press TV five times between 2009 and 2012 and was paid £20k to do so (come on dude):…
18. Press TV's approach was to find left-leaning, sympathetic voices who weren’t Iranian to make the network’s coverage seem legitimate. Again, parallels to RT’s early days. Going back to, you find a lot of Press TV content:…
19. Likewise, sources Middle East news from, which in turn posts Press TV content. was registered in 2014 by Persian Domain Provider, closing the loop.
20. Basically, using open sources, you can verify FireEye’s claims. But it is worth looking at the assertion that Iranian actors “continue to engage in and experiment” with influence operations in light of the information gathered here. The interconnections here are confusing.
21. Part of the reason is that it is all very sloppy i.e. using the name for one site on the registration record for another. It doesn’t reflect a deliberate attempt to hide the connections. Plus, if you want to hide WHOIS info, you can pay for that service.
22. Let’s go back to the dates. Persian Domain Provider registered the sites between 2014-2016. If this is the person referred to by FireEye, then their primary period of activity is well before Russia’s Internet Research Agency operation changed how we think about social media.
23. Basically, I think FireEye/Facebook/Twitter has stumbled upon the past amateurish efforts of Press TV and its affiliates to create influential news platforms on the basis of ad hoc web development, leftist sympathizers, and social media tools (including--recently--bots).
24. This is very different from an army of trolls assembled by an intelligence agency. Even FireEye seems to acknowledge the limits of the influence effort. If you know what Press TV is, it is a lot less threatening. Not the "election meddling" the Trump admin has bandied.
25. What is the kicker here? The support for the #JCPOA. The nuclear deal is not exactly well regarded by the "malign actors" Iran’s military and intelligence establishment. It’s unlikely they would spend one iota of energy trying to sing its graces on the internet.
26. tl;dr #Iran is pumping out fake news as it has for years and years. Social media makes that easier. But we should be careful about jumping to conclusions about Russian-levels of intention and resources.
27. Also, Facebook/Twitter's bold move to ban the relevant accounts is in one way commendable--at least they acted fast. But by my reading its hard to see how places like RT (as state news organs) or Alternet/Breitbart (as veering-towards-fake news) would retain their platform.
28. It is pretty clear that the label "Iran" made it politically easy to decide to ban the accounts, whereas Alex Jones gets a pass. But if we are measuring harms... is anyone reading Instituto Manquehue?
29. As a final point, it would behoove security firms like @FireEye to incorporate a bit of qualitative analysis. If they can't evaluate the information contextually, they aren't really able to weigh the security vs. speech risks accurately. The network is just part of the story.
30. @RidT makes some similar observations on scale and age of efforts:

• • •

Missing some Tweet in this thread? You can try to force a refresh

Keep Current with Esfandyar Batmanghelidj

Esfandyar Batmanghelidj Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!


Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @yarbatman

Sep 14, 2018
THREAD: As protests continue and the rial tumbles, #Iran is increasingly seen as an economic basket case that has squandered its chance to join the ranks of the #BRICs. Here are 7 charts that challenge that view.…
Back in January, I told @folha reporter @DiogoBercito that I saw parallels between the Brazilian protests that have been running since 2014 and those in Iran. In both contexts you hear calls to overthrow the government.…
This is the same reaction to the same macroeconomic failures. The frustrated cry of the Iranian protestor is the same cry as that of the Brazilian protestor. Sure, there is some local political and economic dialect. But the language of corruption and inequality is the same.
Read 13 tweets
Aug 20, 2018
1. I spend a lot of my time thinking and writing about #Iran. This has a lot to do with meeting Dr. Ehsan Yarshater when I was a high school junior. I am so pleased with the news of a $10 million gift to secure his legacy.
2. Back in 2009, I had a vague idea that I wanted to go to @Columbia. Good school + New York seemed enough justification. But my grandmother recommended I go see Dr. Yarshater, an old friend, to learn more about the university.
3. It wasn't the most logical advice. I don't think my grandmother was really aware that Yarshater had not taught for many, many years and that he'd probably have little practical advice for a prospective undergraduate. But I had no idea either, so I gamely traveled to NY.
Read 17 tweets
Aug 3, 2018
1. I wanted to collect some of the years of reporting and writing that highlights why sanctions on #Iran are a sledgehammer, not a scalpel. The only certain outcome of sanctions is pain and suffering for ordinary people. Everything else is a gamble at best. Photo: @Newshaphoto
2. @jrezaian:"The next time an 'Iran expert' tells you that he supports the most crushing sanctions on the regime because they are the best way to support the Iranian people, be sure to ask him the last time he lived through something like this."…
3. @pedestrian: "An economist I know from the University of Tehran put it this way: 'Sanctioning a country like this is similar to permanently disabling a human being. You might stop inflicting harm, but the damage is there forever.'"…
Read 16 tweets
Aug 2, 2018
1. The #Trump administration would like us to believe its sanctions policy is about changing “the behavior of the leadership in #Iran to comport with what the Iranian people really want." Now we have the chance to test whether this is really true.…
2. As I write in @bopinion, #Iran has a new central bank governor, Abdolnasser Hemmati. He has a lot on his plate. A currency crisis exacerbated by sanctions fears took his predecessor down. The Central Bank of Iran is going to be placed under sanctions once again next week.
3. European governments are working to find ways to facilitate payments to #Iran's central bank despite the returning US sanctions. But Iran needs to meet the reform requirements set by #FATF to better prevent financial crime. This is a precondition for these special solutions.
Read 9 tweets
Jul 20, 2018
1. On Sunday, @SecPompeo will speak at an event to "support Iranian voices." Some in the Iranian-American community see the #Trump administration as allies in bringing secular democracy to #Iran.

As an Iranian-American, I find this so, so troubling.…
2. Most proponents of regime change agree on a vision of #Iran as “a secular, parliamentary democracy" though they are light on specifics. There is something *totally wild* about casting Pompeo as an ally for any political movement that places secularism on a pedestal.
3. You might think Pompeo's anti-Islam views would be what undercuts any claims that he cares about Iran's common people. He has stated, "The threat to America is from people who deeply believe that Islam is the way and the light and the only answer."
Read 14 tweets
Jul 19, 2018
1. @Najmeh_Tehran, the journalist who wrote this piece, is immense. This is an issue she has been covering for years on the ground in #Tehran. You and colleagues at @FDD have cited her reporting in papers, briefings, and testimony. But let's put that aside for a second.
2. Maybe we can find another source that's "capable of writing accurately." How about Ken Katzman, who @FDD has welcomed to its events as "a foremost expert on Iran’s Revolutionary Guard Corps and sanctions policy at Congress’ think tank, the Congressional Research Service."
3. The phenomenon described in @Najmeh_Tehran's piece is a simple one. The reapplication of sanctions undermines a moderate president whose primary foreign policy achievement was their removal. As sanctions return, hardline elements, such as the IRGC, are poised to regain power.
Read 13 tweets

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!


0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy


3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us on Twitter!