C. Shawn Eib Profile picture
Sep 21, 2018 17 tweets 11 min read Twitter logo Read on Twitter
After the threads from @conspirator0 and @propornot re: @propornotapp (now suspended), decided to look for any interesting breadcrumbs they may have left behind. Wound up learning about #Nationalist parties of Bulgaria and a few other tidbits. #osint #bots #disinformation
First thing that turned up was this article from the site newsbeezer(.)com (site title: Bulgaria Evening News). As you can see in the screenshot, @PropOrNotApp is quoted discussing conditions during fires in neighboring Greece. Sure, why not?
What else is on this site? Well, they appear to be big fans of the National Front for the Salvation of Bulgaria, normally abbreviated to NFSB, though oddly they seem to alternate the abbreviation between NFFS and NPSB. Neither appear affiliated with another political party.
The NFSB is a member of the current ruling coalition in Bulgaria, called the United Patriots. The United Patriots are aligned with the nominally Pro-EU GERB party but that position has lost some of its strength due to the alliance. Here’s a quick look at UP’s positions and makeup
So what is the NFSB all about? Let’s see: first pic is a quote from NFSB’s leader re Roma. He’s a deputy PM. Good lord. Second was a EU-skeptic coalition of parties they were a member of, along with #UKIP of #Brexit fame. So pro-Kremlin, anti-EU, anti-immigrant, nationalist. Hmm.
So who’s behind this site? It’s hosted in the US by Namecheap and registered anonymously, but there’s a clue left in the Start of Authority or SOA DNS record: the email address rockpura786@gmail(.)com. This email is in two other domains records, vaaju(.)com and remonews(.)com
SOA, or Start of Authority, records are part of the system that allows you to type “google.com” instead of an IP address, known as DNS. This particular records tells you the contact for DNS problems. Since they’re using Namecheap with custom servers, that’s them.
Vaaju(.)com might have some slight bias behind it; remonews(.)com less obviously so, but not radically different. First pics are vaaju(.)com and second are remonews(.)com’s current headlines.
Remember the odd use of NFFS for the NFSB party? First relevant result found (nothing else seemed to be referencing a Bulgarian political party). Also they credit Descant as the author, which is the NFSB newspaper. Possibly avoiding detection of content scraping?
So far no additional information as to the identity of the person/organization using that email, but if anything else is found I’ll add it to this thread.
The @PropOrNotApp account stood out in tweets collected through May in this research paper for its use of the hashtag #fakenews, though they falsely believe it to be associated with the @propornot effort. blogs.oii.ox.ac.uk/policy/wp-cont…
Between the email address found in all three sites, the dates at which they went live (April 2018), common infrastructure (all use Namecheap and WhoisGuard), similar messaging, and reuse of website templates, the shared ownership of these sites is fairly obvious.
So the question is what if any affiliation exists between @PropOrNotApp and the creator of these sites? The account was created to spread mis/disinformation about people studying the same. Their being quoted by a site, one of a few run by the same person(s), pushing the type of
#Disinformation that @propornot works to expose seems suspicious but could be as simple as two like minded people, and the writer of this article followed @ProporNotapp. With the account suspended, I haven’t found the full text yet. If anyone wants to share, my DMs are open :)
Regardless the look into Kremlin-aligned far-right parties was interesting, and a good reminder that information is just weaponized against America; our friends and allies are under attack as well. So thank you to @conspirator0 and @propornot for a fun night!
All articles from thread (visit at your own risk, can’t guarantee there’s nothing malicious on them) newsbeezer.com/bulgariaeng/gr… newsbeezer.com/bulgariaeng/th… balkanist.net/bulgarias-far-…
Isn’t!!! @twitter please, flag em as such if you want, but give us a damn edit button!!!

• • •

Missing some Tweet in this thread? You can try to force a refresh

Keep Current with C. Shawn Eib

C. Shawn Eib Profile picture

Stay in touch and get notified when new unrolls are available from this author!

Read all threads

This Thread may be Removed Anytime!


Twitter may remove this content at anytime! Save it as PDF for later use!

Try unrolling a thread yourself!

how to unroll video
  1. Follow @ThreadReaderApp to mention us!

  2. From a Twitter thread mention us with a keyword "unroll"
@threadreaderapp unroll

Practice here first or read more on our help page!

More from @realShawnEib

Sep 24, 2018
Meet Tim Graboski, aka whiterook6. He works for AggregateIQ as software developer. If that name sounds familiar, it’s because they helped #CambridgeAnalytica during the 2016 election. And apparently they’re still interested in our elections. #Midterms2018 #osint #infosec
We know that part of the seed data for the models used by CA came from Facebook surveys users filled in as part of an app. Well doesn’t this look familiar....this is a project called Campaign Pillar aka Check-In. “AIQ” is plainly visible. As are the targeted election questions.
Well this little gem comes to us courtesy of Tim’s GitHub repository, found here : github.com/whiterook6/che… Currently available to the public (cloned in case it comes down).
Read 10 tweets
Sep 23, 2018
.@judicialnetwork is picking #SCOTUS for us, first #Gorsuch now #Kavanaugh. @ZeldaShagnasty shows here, the domain confirmkavanaugh(.)com was registered in 2/17. 3 similar sites (.net, .info and confirmkavanaughnow(.)com) in 7/18, all three on the same day. #osint #infosec
That date was 7/10/2018. Given that all domains were registered through GoDaddy’s anonymous registration service, WHOIS doesn’t tell us much. But the site is copywritten to @judicialnetwork, so we know they’re involved. Let’s take a look at the page source for the .com site:
Notice something? A template created for a Gorsuch themed site is being used for #Kavanaugh. Was there a confirmgorsuch(.)com too? Blank page currently, but sure enough one was setup 12/19/2016. And taken down 7/9/2018. Well, when did confirmkavanaugh(.)com go live?
Read 10 tweets
Aug 15, 2018
THREAD: by now, many of you have seen posts or articles re: @defcon’s @VotingVillageDC, and the ease with which machines and websites were attacked and exploited. And now, THIS is happening....#unhackthevote #infosec #ElectionSecurity
For YEARS, advocates of election integrity have been pointing out these issues. This isn’t new. After 2000, the Help America Vote Act was passed to modernize our elections, first proposed by Robert Ney (R-OH). Signed into law by George W. Bush. So much for this theory:
At the same time, Bush’s @TheJusticeDept began an investigation into alleged #VoterFraud. Guess what it turned up? No masses of non-citizens voting, nothing that could come close to altering an election. nytimes.com/2007/04/12/was…
Read 15 tweets
Jul 5, 2018
In conjunction with @SlickRockWeb, now let’s take a look at #WalkAway from a different perspective. Who’s the man behind the curtain, and who’s backing him? His name is Brandon Straka, know here as @UsMinority. Let’s get to know him a bit. #infosec #osint #psyops
Before #WalkAway took off (with surprising rapidity), Straka was a performance artist and stylist in New York. His most recent work appears to have been this show, showing his evolution away from #TheResistance. Here’s a link to the GoFundMe gofundme.com/resist-a-rock-…
His first announcement of the #WalkAway campaign was on May 26th. However, shortly after the dates of his show, on a Facebook post dated 10/27/17, we see the following exchange after a post about @TheEllenShow, which appears to be the first public use of the “walk away” idea.
Read 14 tweets
May 2, 2018
This is the type of absolute denial of facts and reality occupying the #MAGA crown. There is no where in America, not one state, where the average gas price is not higher, generally by between 40-50 cents, according to the AAA, not known for faking basic data for partisanship.
The link to where you can see this for yourself is provided. I just looked at all fifty states. No state has longer cost gas today than a year ago. And for this particular statement to be true, the cost would actually need to be approx $1.30-$1.50 cheaper than current averages.
For many places, that would mean it being down by almost 50% or more from the average price. Wherever this half of gas sale is, I’d love to know. So there are two options here: this person lives in the one place in America where gas prices are at $1.75 or so, or they are wrong.
Read 19 tweets

Did Thread Reader help you today?

Support us! We are indie developers!

This site is made by just two indie developers on a laptop doing marketing, support and development! Read more about the story.

Become a Premium Member ($3/month or $30/year) and get exclusive features!

Become Premium

Don't want to be a Premium member but still want to support us?

Make a small donation by buying us coffee ($5) or help with server cost ($10)

Donate via Paypal

Or Donate anonymously using crypto!


0xfe58350B80634f60Fa6Dc149a72b4DFbc17D341E copy


3ATGMxNzCUFzxpMCHL5sWSt4DVtS8UqXpi copy

Thank you for your support!

Follow Us on Twitter!